CVE-2021-26635: Bandisoft ARK Library buffer overflow vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-02 · updated 2026-06-17
Weakness: CWE-121

Description

In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wrong use of the data type. An attacker could use this vulnerability to cause a stack buffer overflow and as a result, perform an attack such as remote code execution.

Affected products

bandisoft ARK: before 7.17 — fixed in 7.17

How to fix

Upgrade to a fixed version: bandisoft ARK 7.17. Check the vendor advisory for mitigations.

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66747
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66747

Get alerted when CVE-2021-26635 or the next vulnerability affects your stack