CVE-2021-24032

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-04 · updated 2026-10-08
Weakness: CWE-277

Description

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

Affected products

Facebook Zstandard: from 1.4.1 before 1.4.9 — fixed in 1.4.9

How to fix

Upgrade to a fixed version: Facebook Zstandard 1.4.9. Check the vendor advisory for mitigations.

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519
https://github.com/facebook/zstd/issues/2491
https://www.facebook.com/security/advisories/cve-2021-24032
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519
https://github.com/facebook/zstd/issues/2491
https://www.facebook.com/security/advisories/cve-2021-24032

Get alerted when CVE-2021-24032 or the next vulnerability affects your stack