What’s Vulnerable › Vulnerabilities

CVE-2021-3522

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-02 · updated 2026-06-17
• Weakness: CWE-125

Description

GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.

Affected products

• GStreamer: before 1.18.4 — fixed in 1.18.4
• Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
• E-Series SANtricity OS Controller Software 11.x: from 11.0.0 through 11.70.1
• NetApp E-Series Santricity Storage Manager: all versions
• NetApp E-Series Santricity Web Services: all versions
• NetApp Hci Management Node: all versions
• OnCommand Insight: all versions
• NetApp OnCommand Workflow Automation: all versions
• NetApp Santricity Unified Manager: all versions
• SnapManager for Oracle: all versions
• NetApp Solidfire: all versions
• containers/openjdk: 8-update301

How to fix

Upgrade to a fixed version: GStreamer 1.18.4. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1954761
• https://security.gentoo.org/glsa/202208-31
• https://security.netapp.com/advisory/ntap-20211022-0004/
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1954761
• https://security.gentoo.org/glsa/202208-31
• https://security.netapp.com/advisory/ntap-20211022-0004/
• https://www.oracle.com/security-alerts/cpuoct2021.html

Get alerted when CVE-2021-3522 or the next vulnerability affects your stack