CVE-2021-43814

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Rizin is a UNIX-like reverse engineering framework and command-line toolset. In versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. No workaround are known and users are advised to upgrade.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
rizinorg	rizin	<= 0.3.1

References

https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406Patch, Third Party Advisory
https://github.com/rizinorg/rizin/issues/2083Third Party Advisory
https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8rThird Party Advisory
https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b5ea406Patch, Third Party Advisory
https://github.com/rizinorg/rizin/issues/2083Third Party Advisory
https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8rThird Party Advisory

Timeline

Published: Dec 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-438154.3Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal fo CVE-2021-438169.1containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS, RHEL), Fedora, or SUSE MicroOS, with co CVE-2021-438176.1Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability CVE-2021-438187.1lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain cra CVE-2021-438195.3Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment. In affected versions Minecarts with chests wi CVE-2021-43828.8The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() CVE-2021-438205.9Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. T CVE-2021-438217.7Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local CVE-2021-438227.5Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affec CVE-2021-438236.5Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings CVE-2021-438247.5Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy CVE-2021-438257.5Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop furth