How severe is CVE-2021-44538?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2021-44538?

This is classified as CWE-119, which is a common weakness in software security.

CVE-2021-44538 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.

Related Vulnerabilities

CVE-1999-1588

CRITICAL

CVSS:9.8(Critical)

Buffer overflow in nlps_server in Sun Solaris x86 2.4, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code as root via a long string beginning with "NLPS:002:002:" to the listen (aka Syst...

CWE-1191999

CVE-2005-3590

CRITICAL

CVSS:9.8(Critical)

The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buff...

CWE-1192005

CVE-2007-5199

CRITICAL

CVSS:9.8(Critical)

A single byte overflow in catalogue.c in X.Org libXfont 1.3.1 allows remote attackers to have unspecified impact.

CWE-1192007

CVE-2007-5341

CRITICAL

CVSS:9.8(Critical)

Remote code execution in the Venkman script debugger in Mozilla Firefox before 2.0.0.8.

CWE-1192007

CVE-2007-6762

CRITICAL

CVSS:9.8(Critical)

In the Linux kernel before 2.6.20, there is an off-by-one bug in net/netlabel/netlabel_cipso_v4.c where it is possible to overflow the doi_def->tags[] array.

CWE-1192007

CVE-2008-3465

CRITICAL

CVSS:9.8(Critical)

Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows context-dependent attackers to cause a de...

CWE-1192008