Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-3504

19
FAUCET Score

CVE-2021-3504 is a medium-severity vulnerability affecting the hivex library (versions prior to 1.3.20) in Debian, Fedora, and Red Hat products. This flaw, a lack of bounds checking in the hivex_open function, allows an unauthenticated attacker to cause a denial of service or information disclosure by tricking a user into opening a specially crafted Windows Registry file. While the vulnerability is not actively exploited, has no public exploit code, and minimal community discussion, its potential impact on system availability warrants attention.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.3.20CPE matchmatch criteria
cpe:2.3:a:redhat:hivex:*:*:*:*:*:*:*:*
6.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.4MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
2.8
Impact Score
2.5
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.93%
Probability of exploitation in next 30 days
EPSS Percentile
77.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0192 is in the 89th percentile among its peer group of 26,234 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (9)

microsoftpatch availablevia msrc
Product: 19071-16823Fixed in: 1.3.21-1
microsoftpatch availablevia msrc
Product: cbl2 hivex 1.3.21-1 on CBL Mariner 2.0Fixed in: 1.3.21-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.3.21-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.3.21-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: virt:rhel-8040020210721215855.522a0ee4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: hivex-0:1.3.10-6.11.el7_9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: virt-devel:rhel-8040020210721215855.522a0ee4
View patch
redhatpatch availablevia nvd_reference
View patch
redhatno patchvia redhat_api
Product: Red Hat Enterprise Linux 8 Advanced VirtualizationFixed in: virt:8.3/hivex

Vendor Advisories (3)

microsoft2021-Dec/CVE-2021-3504

CVE-2021-3504

Dec 14, 2021
microsoft2021-May/CVE-2021-3504Moderate

A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.

May 11, 2021
redhatCVE-2021-3504Moderate

hivex: Buffer overflow when provided invalid node key length

May 3, 2021

References

bugzilla.redhat.com / show_bug.cgi
Issue TrackingPatchThird Party Advisory
lists.debian.org / debian-lts-announce/2021/05/msg00011.html
Mailing ListThird Party Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/A5BNKNVYFL36P2GBEB5O36LHFRYU575H
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/BQXTEACRWYAZVNEOIWIYUFGG4GOXSQ22