Buffer overflow in Bandisoft Ark Library
CVE-2021-26635
In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data type. An attacker could use this vulnerability to cause a stack buffer overflow and as a result, perform an attack such as remote code execution.
Vulnerability class: Buffer Overflow
EPSS: 0.011 (62.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Bandisoft Ark_library
- Bandisoft International Inc. Ark Library — versions unspecified
Weakness classification (CWE)
References
- vuln@krcert.or.kr (Third Party Advisory, x_refsource_MISC, Broken Link)
Frequently asked questions
- What is CVE-2021-26635?
- CVE-2021-26635 is a high-severity vulnerability in Bandisoft Ark Library, classified under Stack-based Buffer Overflow. CVSS score: 7.8/10. Published 2022-06-02.
- How severe is CVE-2021-26635?
- High severity. CVSS v3 base score is 7.8 out of 10.