CVE-2021-30354 is an Integer Overflow vulnerability in Amazon Kindle e-readers, specifically in firmware versions prior to and including 5.13.4. This flaw, residing in the CJBig2Image::expand() function, leads to a Heap-Based Buffer Overflow when processing a specially crafted PDF book. The vulnerability carries a high CVSS score of 8.6, indicating a local attack vector with low complexity, requiring user interaction, but capable of achieving high impact across confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB) is unavailable, and community discussion and media coverage are limited, though it was highlighted at DEFCON.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 5.13.4CPE matchmatch criteria | cpe:2.3:o:amazon:kindle_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.