CVE-2021-32559

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0017/FEYE-2021-0017.mdThird Party Advisory
https://github.com/mhammond/pywin32/issues/1700Patch, Third Party Advisory
https://github.com/mhammond/pywin32/pull/1701Third Party Advisory
https://github.com/mhammond/pywin32/releasesRelease Notes, Third Party Advisory
https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0017/FEYE-2021-0017.mdThird Party Advisory
https://github.com/mhammond/pywin32/issues/1700Patch, Third Party Advisory
https://github.com/mhammond/pywin32/pull/1701Third Party Advisory
https://github.com/mhammond/pywin32/releasesRelease Notes, Third Party Advisory

Timeline

Published: Jul 6, 2021
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-32566.5KuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html_url parameter of the chakanhtml.module.php file.CVE-2021-325606.5The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.CVE-2021-325616.1OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.CVE-2021-325639.8An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it del CVE-2021-325657.5Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache CVE-2021-325667.5Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache T CVE-2021-325677.5Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache T CVE-2021-325687.8mrdoc is vulnerable to Deserialization of Untrusted Data CVE-2021-325696.1In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. Thi CVE-2021-325704.9In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from cert CVE-2021-325714.9In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and passwords are left in CVE-2021-325727.5Speco Web Viewer through 2021-05-12 allows Directory Traversal via GET request for a URI with /.. at the beginning, as demonstrated by readi