← Database

CVE-2021-3520

CRITICAL CVSS: 9.8 Published: 2021-06-02 Modified: 2026-06-17

Description

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Affected Platforms

Netapp Ontap Select Deploy Administration UtilityLz4 Project Lz4Netapp Active Iq Unified ManagerOracle Communications Cloud Native Core PolicyOracle Zfs Storage Appliance KitNetapp Cloud BackupSplunk Universal Forwarder

Weakness Type

CWE-190, CWE-190, CWE-787

References