What’s Vulnerable › Vulnerabilities

CVE-2021-35331

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-07-05 · updated 2026-06-17
• Weakness: CWE-134

Description

In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding

Affected products

• Tcl: 8.6.11

References

• https://core.tcl-lang.org/tcl/info/28ef6c0c741408a2
• https://core.tcl-lang.org/tcl/info/bad6cc213dfe8280
• https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222
• https://sqlite.org/forum/info/7dcd751996c93ec9
• https://core.tcl-lang.org/tcl/info/28ef6c0c741408a2
• https://core.tcl-lang.org/tcl/info/bad6cc213dfe8280
• https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222
• https://sqlite.org/forum/info/7dcd751996c93ec9

Get alerted when CVE-2021-35331 or the next vulnerability affects your stack