What’s Vulnerable › Vulnerabilities

CVE-2021-22545: Use-after-free in BinDiff

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-29 · updated 2026-06-17
• Weakness: CWE-416

Description

An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the attacker to control the instruction pointer and execute arbitrary code. It is recommended to upgrade BinDiff 7

Affected products

• Google LLC Bindiff: before 7.0 — fixed in 7.0

How to fix

Upgrade to a fixed version: Google LLC Bindiff 7.0. Check the vendor advisory for mitigations.

References

• https://www.zynamics.com/bindiff/manual/index.html#nyyyy7
• https://www.zynamics.com/bindiff/manual/index.html#nyyyy7

Get alerted when CVE-2021-22545 or the next vulnerability affects your stack