CVE-2021-36087 Memory corruption in n/a

Low 3.3 Published 1 Jul 2021 Updated 14 Oct 2026

A heap-based buffer over-read in the SELinux CIL compiler allows attackers to cause denial of service or disclose sensitive memory contents via invalid optional block statements.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2021-36087?

CVE-2021-36087 is a low-severity memory corruption vulnerability in Fedoraproject Fedora, published on 1 Jul 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). This occurs because there is sometimes a lack of checks for invalid statements in an optional block.

Weakness: CWE-125

Which versions are affected by CVE-2021-36087?

It affects 2 products.

Products include Fedoraproject Fedora, Selinux Project Selinux.

How do I fix CVE-2021-36087?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-36087 being exploited?

There is no known exploitation of CVE-2021-36087 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-36087, GHSA-xjc2-37xp-26m5, UBUNTU-CVE-2021-36087.