CVE-2021-32272 describes a heap-buffer-overflow vulnerability in the faad2 audio decoder, specifically within the stszin function in mp4read.c, affecting versions prior to 2.10.0 and various Debian distributions. This high-severity flaw (CVSS 7.8) can be triggered by an unauthenticated attacker through user interaction (e.g., opening a malicious file), potentially leading to arbitrary code execution with high impact on confidentiality, integrity, and availability. While the vulnerability is not listed on the KEV catalog and has no known public exploits or significant community discussion, its potential for code execution warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.10.0CPE matchmatch criteria | cpe:2.3:a:faad2_project:faad2:*:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.