CVE-2021-26461: malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-21 · updated 2026-06-17
Weakness: CWE-190

Description

Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.

Affected products

Apache Software Foundation Apache NuttX RTOS: before 10.1.0 — fixed in 10.1.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache NuttX RTOS 10.1.0. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread.html/r806fccf8b003ae812d807c6c7d97950d44ed29b2713418cbe3f2bddd%40%3Cdev.nuttx.apache.org%3E
https://lists.apache.org/thread.html/r806fccf8b003ae812d807c6c7d97950d44ed29b2713418cbe3f2bddd%40%3Cdev.nuttx.apache.org%3E

Get alerted when CVE-2021-26461 or the next vulnerability affects your stack