CVE-2021-32277 describes a heap-buffer-overflow vulnerability in the sbr_qmf_analysis_32 function within faad2 versions up to 2.10.0, potentially affecting Debian and faad2_project distributions. This high-severity vulnerability (CVSS 7.8) can lead to arbitrary code execution with low attack complexity, requiring user interaction but no prior privileges. While the EPSS score is very low and it's not listed in CISA's KEV catalog, there is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it has received no community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.10.0CPE matchmatch criteria | cpe:2.3:a:faad2_project:faad2:*:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.