CVE-2021-21772

A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0

High · published March 10, 2021

CVSS v3.0
8.1
EPSS
4%
Percentile
90.9
In the wild
Unconfirmed
What it is

A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04170 · 90.9th percentile
Published
2021-03-10T00:00Z
EPSS history
Timeline
  • 10 MAR 00:00Z
    A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0
    cvelistv5