CVE-2021-20204
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when...
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
- Record
CVE-2021-20204- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119, CWE-416
- Updated
- 2026-11-02
CVE List
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
- Record
CVE-2021-20204- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2021-7648
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
- Record
EUVD-2021-7648- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mjc7-82x6-3544
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when...
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
- Record
GHSA-mjc7-82x6-3544- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-416
- Updated
- 2026-11-02
OSV
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
- Record
CVE-2021-20204- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-20204
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
- Record
DEBIAN-CVE-2021-20204- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-20204
A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.
- Record
UBUNTU-CVE-2021-20204- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1645-1 No score
Security update for getdata
getdata was updated to 0.11.0, fixing bugs and a security issue:
- CVE-2021-20204: Fixed a use after free in _GD_Supports() in encoding.c (boo#1186251)
for all relevant changes see: https://github.com/ketiltrout/getdata/releases/tag/v0.11.0
- Record
openSUSE-SU-2021:1645-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgetdataDebian:12 |
before 0.10.0-10 | 0.10.0-10 |
libgetdataDebian:13 |
before 0.10.0-10 | 0.10.0-10 |
libgetdataDebian:14 |
before 0.10.0-10 | 0.10.0-10 |
libgetdataDebian:9 |
before 0.9.4-1+deb9u1, plus listed versions 0.9.4-1 |
0.9.4-1+deb9u1 |
libgetdataUbuntu:16.04:LTS |
All versions, plus listed versions 0.7.3-6.2ubuntu10.9.0-20.9.0-2.10.9.0-2.2 |
None known |
libgetdataUbuntu:18.04:LTS |
All versions, plus listed versions 0.10.0-3build2 |
None known |
libgetdataUbuntu:20.04:LTS |
All versions, plus listed versions 0.10.0-60.10.0-6build20.10.0-6build3 |
None known |
libgetdataUbuntu:22.04:LTS |
All versions, plus listed versions 0.10.0-100.11.0-10.11.0-20.11.0-2build10.11.0-3ubuntu1 |
None known |
libgetdataUbuntu:24.04:LTS |
All versions, plus listed versions 0.11.0-60.11.0-70.11.0-7ubuntu10.11.0-100.11.0-11 Show 4 moreShow less0.11.0-120.11.0-12build10.11.0-12build30.11.0-13 |
None known |
libgetdataUbuntu:25.10 |
All versions, plus listed versions 0.11.0-15 |
None known |
libgetdataUbuntu:26.10 |
All versions, plus listed versions 0.11.0-17build10.11.0-17build2 |
None known |
libgetdataUbuntu:26.04:LTS |
All versions, plus listed versions 0.11.0-150.11.0-160.11.0-170.11.0-17build1 |
None known |
getdataopenSUSE:Leap 15.2 |
before 0.11.0-lp152.4.3.1 | 0.11.0-lp152.4.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-20204 is a critical vulnerability (CVSS 9.8) in Getdata Project Getdata, published May 6, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in libgetdata 0.10.0-10.
References
bugzilla.redhat.com/show_bug.cgi?id=1956348
lists.debian.org/debian-lts-announce/2021/05/msg00015.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OE23HBLIVKVPOQ5MVADWPOCFMREVF4QZ
nvd.nist.gov/vuln/detail/CVE-2021-20204
Show 10 moreShow less
github.com/advisories/GHSA-mjc7-82x6-3544
security-tracker.debian.org/tracker/CVE-2021-20204
ubuntu.com/security/CVE-2021-20204
cve.org/CVERecord?id=CVE-2021-20204
lists.opensuse.org/archives/list/[email protected]/thread/DLVFS4U5WQY3UT4TIXF3TKNGVMQCDKHC
bugzilla.suse.com/1186251
suse.com/security/cve/CVE-2021-20204