CVE-2021-24031

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Zstandard command-line utility prior to v1.4.1, output files were created with default permissions. Correct file permissions (matching the input) would only be set at completion time. Output files could therefore be readable or writable to unintended parties.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-277 CWE-276

Affected software

Vendor	Product	Versions
Facebook	Zstandard	>= unspecified, < 1.4.1

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404Exploit, Issue Tracking, Mailing List, Third Party Advisory
https://github.com/facebook/zstd/issues/1630Exploit, Issue Tracking, Third Party Advisory
https://www.facebook.com/security/advisories/cve-2021-24031Vendor Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=981404Exploit, Issue Tracking, Mailing List, Third Party Advisory
https://github.com/facebook/zstd/issues/1630Exploit, Issue Tracking, Third Party Advisory
https://www.facebook.com/security/advisories/cve-2021-24031Vendor Advisory

Timeline

Published: Mar 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-240324.7Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output file CVE-2021-240335.6react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be CVE-2021-240359.1A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 CVE-2021-240369.8Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with CVE-2021-240379.8A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers CVE-2021-240387.8Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged p CVE-2021-24046.5Vulnerability in the PeopleSoft Enterprise HCM Candidate Gateway product of Oracle PeopleSoft (component: e-mail notification). The supporte CVE-2021-240409.8Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicio CVE-2021-240419.8A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could ha CVE-2021-240429.8The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.CVE-2021-240439.1A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp CVE-2021-240449.8By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would