CVE-2021-3674

A flaw was found in rizin. The create_section_from_phdr function allocates space for ELF section data by processing the headers. Crafted values in the headers can cause out of bounds reads, which can lead to memory corruption and possibly code execution through the binary object's callback function.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2023-03-24

Updated

2025-02-25

Proof-of-concept exploits (2)

• https://gist.github.com/netspooky/61101e191afee95feda7dbd2f6b061c4
• rizinorg/rizin/pull/1313

References

• CVE Record
• NVD entry

Related

• CVE-2025-1786
• CVE-2025-1788
• CVE-2021-36713
• CVE-2021-36747
• CVE-2021-36711
• CVE-2021-36748