CVE-2021-44538

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-14 · updated 2026-06-17
Weakness: CWE-119

Description

The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.

Affected products

Cinny Project Cinny: before 1.6.0 — fixed in 1.6.0
Debian Linux: 9.0, 10.0, 11.0
Matrix Element: before 1.9.7 — fixed in 1.9.7
matrix-org matrix-js-sdk: from 2.4.2 before 15.2.1 — fixed in 15.2.1
Matrix Olm: from 3.1.4 before 3.2.8 — fixed in 3.2.8
Schildichat: before 1.9.7-sc1 — fixed in 1.9.7-sc1

How to fix

Upgrade to a fixed version: Cinny Project Cinny 1.6.0; Matrix Element 1.9.7; matrix-org matrix-js-sdk 15.2.1; Matrix Olm 3.2.8; Schildichat 1.9.7-sc1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-44538 or the next vulnerability affects your stack