CVE-2021-45960 Integer overflow in n/a
An integer overflow in libexpat's storeAtts function can cause memory corruption, potentially leading to denial of service or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-45960?
CVE-2021-45960 is a high-severity vulnerability in Debian Debian Linux, published on 1 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Weakness: CWE-682
Which versions are affected by CVE-2021-45960?
It affects 8 products.
Products include Debian Debian Linux, Libexpat Project Libexpat, Netapp Active Iq Unified Manager, Netapp Hci Baseboard Management Controller, Netapp Oncommand Workflow Automation, Netapp Solidfire \& Hci Management Node and 2 more.
How do I fix CVE-2021-45960?
Upgrade to a fixed version.
Is CVE-2021-45960 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-45960 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-45960, AZL-7124, CLEANSTART-2026-CC51357, DEBIAN-CVE-2021-45960, GHSA-pfmv-2r4f-j9mj, JLSEC-2025-42 and 1 more.