CVE-2021-45423 Memory corruption in n/a
A buffer overflow in the Pev binary analysis tool allows arbitrary code execution via a crafted PE file due to incorrect array bounds checking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45423?
CVE-2021-45423 is a critical memory corruption vulnerability in n/a, published on 13 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c.. The array offsets_to_Names is dynamically allocated on the stack using exp->NumberOfFunctions as its size. However, the loop uses exp->NumberOfNames to iterate over it and set its components value. Therefore, the loop code assumes that exp->NumberOfFunctions is greater than ordinal at each iteration. This can lead to arbitrary code execution.
Weakness: CWE-120
Which versions are affected by CVE-2021-45423?
It affects 1 product.
Products include Pev Project Pev.
How do I fix CVE-2021-45423?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-45423 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-45423 exists.
Sources
Also known as DEBIAN-CVE-2021-45423, GHSA-4r8p-6r2m-cjwv, UBUNTU-CVE-2021-45423.