Every CVE Search/ Get API key

CVE-2021-3700

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the...

6.4 MediumFix available

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.31%Down 0.6 points since Feb 25, 2022
90%50%10%1%

What each source reports

NVD Score used 6.4

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Record
CVE-2021-3700
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-416
Updated
2026-11-02
CVE List No score

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Record
CVE-2021-3700
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2021-26985 No score

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Record
EUVD-2021-26985
Updated
2026-11-03
GitHub AdvisoriesGHSA-9885-wxqj-48q7 6.4

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the...

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Record
GHSA-9885-wxqj-48q7
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2021-3700 6.4

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Record
ALPINE-CVE-2021-3700
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-8824 6.4

CVE-2021-3700 affecting package usbredir for versions less than 0.12.0-1

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Record
AZL-8824
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVBELL-CVE-2021-3700 6.4

CVE-2021-3700 does not affect BellSoft software

Record
BELL-CVE-2021-3700
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 6.4

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Record
CVE-2021-3700
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3700 6.4

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Record
DEBIAN-CVE-2021-3700
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1355 3.9

usbredir security update

usbredir is the name of a network protocol for sending USB device traffic over a network connection. It is also the name of the software package offering a parsing library, a usbredirhost library and several utilities implementing this protocol. It also including a USB host TCP server, using libusbredirhost.

Security Fix(es):

No description is available for this CVE.(CVE-2021-3700)

Record
OESA-2021-1355
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3700 6.4

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.

Record
UBUNTU-CVE-2021-3700
CVSS 3.1
6.4 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2022-0133 No score

Updated usbredir packages fix security vulnerability

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination. (CVE-2021-3700)

Record
MGASA-2022-0133
Updated
2026-11-02
OSVopenSUSE-SU-2024:11489-1 No score

libusbredirhost1-0.11.0-1.2 on GA media

These are all security issues fixed in the libusbredirhost1-0.11.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11489-1
Updated
2026-11-02
OSVUSN-5784-1 No score

usbredir vulnerability

It was discovered that usbredir incorrectly handled memory when serializing large amounts of data in the case of a slow or blocked destination. An attacker could possibly use this issue to cause applications using usbredir to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-5784-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
usbredir
Alpine:v3.16
 before 0.12.0-r0
0.12.0-r0
usbredir
Alpine:v3.17
 before 0.12.0-r0
0.12.0-r0
usbredir
Alpine:v3.18
 before 0.12.0-r0
0.12.0-r0
usbredir
Alpine:v3.19
 before 0.12.0-r0
0.12.0-r0
usbredir
Alpine:v3.20
 before 0.12.0-r0
0.12.0-r0
usbredir
Alpine:v3.21
 before 0.12.0-r0
0.12.0-r0
usbredir
Alpine:v3.22
 before 0.12.0-r0
0.12.0-r0
usbredir
Alpine:v3.23
 before 0.12.0-r0
0.12.0-r0
usbredir
Alpine:v3.24
 before 0.12.0-r0
0.12.0-r0
usbredir
Azure Linux:2
 before 0.12.0-1
0.12.0-1
Show 12 moreShow less
Affected packages
PackageAffectedFixed
usbredir
Debian:12
 before 0.11.0-1
0.11.0-1
usbredir
Debian:13
 before 0.11.0-1
0.11.0-1
usbredir
Debian:14
 before 0.11.0-1
0.11.0-1
usbredir
Debian:9
 before 0.7.1-1+deb9u1, plus listed versions
0.7.1-1
0.7.1-1+deb9u1
usbredir
Mageia:8
 before 0.8.0-3.1.mga8
0.8.0-3.1.mga8
usbredir
openEuler:20.03-LTS-SP1
 before 0.8.0-5.oe1
0.8.0-5.oe1
usbredir
openEuler:20.03-LTS-SP2
 before 0.8.0-5.oe1
0.8.0-5.oe1
usbredir
Ubuntu:Pro:14.04:LTS
 before 0.6-2ubuntu1.1+esm1, plus listed versions
0.6-20.6-2ubuntu10.6-2ubuntu1.1
0.6-2ubuntu1.1+esm1
usbredir
Ubuntu:Pro:16.04:LTS
 before 0.7.1-1ubuntu0.16.04.1~esm1, plus listed versions
0.7-1ubuntu20.7.1-1
0.7.1-1ubuntu0.16.04.1~esm1
usbredir
Ubuntu:18.04:LTS
 before 0.7.1-1ubuntu0.18.04.1, plus listed versions
0.7.1-1
0.7.1-1ubuntu0.18.04.1
usbredir
Ubuntu:20.04:LTS
 before 0.8.0-1ubuntu0.1, plus listed versions
0.8.0-1
0.8.0-1ubuntu0.1
usbredir
openSUSE:Tumbleweed
 before 0.11.0-1.2
0.11.0-1.2

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3700 is a medium vulnerability (CVSS 6.4) in Microsoft Usbredir, published September 30, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in usbredir 0.12.0-r0.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open