CVE-2021-42203

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in swftools through 20201222. A heap-use-after-free exists in the function swf_FontExtract_DefineTextCallback() located in swftext.c. It allows an attacker to cause code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/matthiaskramm/swftools/issues/176Exploit, Third Party Advisory
https://github.com/matthiaskramm/swftools/issues/176Exploit, Third Party Advisory

Timeline

Published: Jun 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-422047.8An issue was discovered in swftools through 20201222. A heap-buffer-overflow exists in the function swf_GetBits() located in rfxswf.c. It al CVE-2021-422054.7ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a s CVE-2021-42214.3If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confu CVE-2021-422169.8A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php.CVE-2021-422187.5OMPL v1.5.2 contains a memory leak in VFRRT.cpp CVE-2021-422197.5Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive am CVE-2021-42224.8The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin CVE-2021-422205.4A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admi CVE-2021-422236.1Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.CVE-2021-422249.8SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.CVE-2021-422276.1Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html CVE-2021-422288.8A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.