CVE-2021-28211

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122CWE-787

Affected software

VendorProductVersions
TianoCoreEDK IIedk2-stable202008

References

Timeline

Published
Jun 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-282137.5Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks.CVE-2021-282167.8BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE.CVE-2021-282338.8Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c.CVE-2021-282359.8Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.CVE-2021-282367.5LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c.CVE-2021-282379.8LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13.CVE-2021-282428.8SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information byCVE-2021-282457.5PbootCMS 3.0.4 contains a SQL injection vulnerability through index.php via the search parameter that can reveal sensitive information throuCVE-2021-282467.8CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regulaCVE-2021-282475.4CA eHealth Performance Manager through 6.3.2.12 is affected by Cross Site Scripting (XSS). The impact is: An authenticated remote user is abCVE-2021-282487.5CA eHealth Performance Manager through 6.3.2.12 is affected by Improper Restriction of Excessive Authentication Attempts. An attacker is ablCVE-2021-282498.8CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. To explo
CVE-2021-28211: Medium severity, CVSS 6.7 | Vulnix