CVE-2021-36976
mediumlibarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
Vendor / product: Libarchive — libarchive
libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).
CVSS
6.5
6.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2021-07-20 07:15
Modified: 2026-11-02 19:17
NVD status: Modified
Last synced 1 day ago
Verified against the source API 2026-11-03 07:33 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
libarchive / libarchive ≥3.4.1 ≤3.5.2
fedoraproject / fedora 35
apple / ipados <15.4
apple / iphone_os <15.4
apple / macos <12.3
apple / watchos <8.5
splunk / universal_forwarder ≥8.2.0 <8.2.12, ≥9.0.0 <9.0.6, 9.1.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- http://seclists.org/fulldisclosure/2022/Mar/27 cve@mitre.org
- http://seclists.org/fulldisclosure/2022/Mar/28 cve@mitre.org
- http://seclists.org/fulldisclosure/2022/Mar/29 cve@mitre.org
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32375 cve@mitre.org
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libarchive/OSV-2021-557.yaml cve@mitre.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... cve@mitre.org
- https://security.gentoo.org/glsa/202208-26 cve@mitre.org
- https://support.apple.com/kb/HT213182 cve@mitre.org
- https://support.apple.com/kb/HT213183 cve@mitre.org
- https://support.apple.com/kb/HT213193 cve@mitre.org
- http://seclists.org/fulldisclosure/2022/Mar/27 af854a3a-2127-422b-91ae-364da2661108
- http://seclists.org/fulldisclosure/2022/Mar/28 af854a3a-2127-422b-91ae-364da2661108
- http://seclists.org/fulldisclosure/2022/Mar/29 af854a3a-2127-422b-91ae-364da2661108
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32375 af854a3a-2127-422b-91ae-364da2661108
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libarchive/OSV-2021-557.yaml af854a3a-2127-422b-91ae-364da2661108
- https://lists.debian.org/debian-lts-announce/2024/11/msg00007.html af854a3a-2127-422b-91ae-364da2661108
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/m... af854a3a-2127-422b-91ae-364da2661108
- https://security.gentoo.org/glsa/202208-26 af854a3a-2127-422b-91ae-364da2661108
- https://support.apple.com/kb/HT213182 af854a3a-2127-422b-91ae-364da2661108
- https://support.apple.com/kb/HT213183 af854a3a-2127-422b-91ae-364da2661108
- https://support.apple.com/kb/HT213193 af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-11-03 07:33 UTC · record ↗