CVE-2021-22545CWE-416

Use-after-free in BinDiff

High · published June 29, 2021

CVSS v3.1
7.5
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the attacker to control the instruction pointer and execute arbitrary code. It is recommended to upgrade BinDiff 7

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.3th percentile
Weakness
CWE-416 · Use After Free
Published
2021-06-29T11:55Z
EPSS history
Timeline
  • 29 JUN 11:55Z
    Use-after-free in BinDiff
    cvelistv5