CVE-2021-3504

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	hivex	hivex-1.3.20

References

https://bugzilla.redhat.com/show_bug.cgi?id=1949687Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00011.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5BNKNVYFL36P2GBEB5O36LHFRYU575H/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQXTEACRWYAZVNEOIWIYUFGG4GOXSQ22/
https://bugzilla.redhat.com/show_bug.cgi?id=1949687Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00011.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5BNKNVYFL36P2GBEB5O36LHFRYU575H/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQXTEACRWYAZVNEOIWIYUFGG4GOXSQ22/

Timeline

Published: May 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-350417.5The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. A malicious node can send CVE-2021-350429.8Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a w CVE-2021-350436.1OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstra CVE-2021-350456.1Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ en CVE-2021-350466.1A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted s CVE-2021-350478.8Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level acce CVE-2021-350489.8Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerabilit CVE-2021-350498.8Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerabil CVE-2021-35055.5A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in CVE-2021-350507.5User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access CVE-2021-350527.8A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.CVE-2021-350537.5Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change specific Firefox browse