CVE-2021-21401: Invalid free() call in Nanopb

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-23 · updated 2026-06-17
Weakness: CWE-763

Description

Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid `free()` or `realloc()` calls if the message type contains an `oneof` field, and the `oneof` directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.

Affected products

nanopb: before 0.3.9.8; from 0.4.0 before 0.4.5 — fixed in 0.3.9.8, 0.4.5

How to fix

Upgrade to a fixed version: nanopb 0.3.9.8, 0.4.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-21401 or the next vulnerability affects your stack