CVE-2021-44847

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-13 · updated 2026-06-17
Weakness: CWE-682

Description

A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calculation during the handling of received network packets) allows remote attackers to crash the process or potentially execute arbitrary code via a network packet.

Affected products

Fedoraproject Fedora: 34, 35
Toktok Toxcore: from 0.1.9 through 0.1.11; from 0.2.0 through 0.2.12

References

https://github.com/TokTok/c-toxcore/pull/1718
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7EBS3NIRYJ7V3PTNINP3PJSVUHGZTGA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLTKINSPO5T65LB3ZASDPCREKUE22RYE/
https://github.com/TokTok/c-toxcore/pull/1718
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7EBS3NIRYJ7V3PTNINP3PJSVUHGZTGA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLTKINSPO5T65LB3ZASDPCREKUE22RYE/

Get alerted when CVE-2021-44847 or the next vulnerability affects your stack