CVE-2021-26567

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-26 · updated 2026-06-17
Weakness: CWE-121

Description

Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.

Affected products

Faad2 Project Faad2: before 2.2.7.1 — fixed in 2.2.7.1
Synology DiskStation Manager: before 6.2.3-25426-3 — fixed in 6.2.3-25426-3
Synology Diskstation Manager Unified Controller: 3.0
Synology Skynas Firmware: all versions
Synology Vs960Hd Firmware: all versions

How to fix

Upgrade to a fixed version: Faad2 Project Faad2 2.2.7.1; Synology DiskStation Manager 6.2.3-25426-3. Check the vendor advisory for mitigations.

References

https://github.com/knik0/faad2/commit/720f7004d6c4aabee19aad16e7c456ed76a3ebfa
https://www.synology.com/security/advisory/Synology_SA_20_26
https://github.com/knik0/faad2/commit/720f7004d6c4aabee19aad16e7c456ed76a3ebfa
https://www.synology.com/security/advisory/Synology_SA_20_26

Get alerted when CVE-2021-26567 or the next vulnerability affects your stack