CVE-2021-31322

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
May 18, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-313235.5Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::pCVE-2021-313249.8The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code ExecutionCVE-2021-313269.8D-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parameter to /goform/form2CVE-2021-313275.4Stored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field.CVE-2021-313295.4Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.phpCVE-2021-31336.5The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.CVE-2021-313305.4A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker mayCVE-2021-313379.8The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow CVE-2021-313387.8A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.0 SP1). Affected devices allow to modify configuratioCVE-2021-313394.3A vulnerability has been identified in Mendix Excel Importer Module (All versions < V9.0.3). Uploading a manipulated XML File results in an CVE-2021-31347.8Mubu 2.2.1 allows local users to gain privileges to execute commands, aka CNVD-2020-68878.CVE-2021-313407.5A vulnerability has been identified in SIMATIC RF166C (All versions > V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2),
CVE-2021-31322: Medium severity, CVSS 5.5 | Vulnix