CVE-2021-32276
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the...
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
- Record
CVE-2021-32276- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
- Record
CVE-2021-32276- Updated
- 2026-11-02
EUVDEUVD-2021-19131 No score
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
- Record
EUVD-2021-19131- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hjhc-4jxh-xxxx
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the...
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
- Record
GHSA-hjhc-4jxh-xxxx- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-32276
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
- Record
ALPINE-CVE-2021-32276- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
- Record
CVE-2021-32276- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-32276
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
- Record
DEBIAN-CVE-2021-32276- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-32276
An issue was discovered in faad2 through 2.10.0. A NULL pointer dereference exists in the function get_sample() located in output.c. It allows an attacker to cause Denial of Service.
- Record
UBUNTU-CVE-2021-32276- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-6313-1 No score
faad2 vulnerabilities
It was discovered that FAAD2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. (CVE-2021-32272, CVE-2021-32273, CVE-2021-32274, CVE-2021-32277, CVE-2021-32278, CVE-2023-38857, CVE-2023-38858)
It was discovered that FAAD2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2021-32276)
- Record
USN-6313-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
faad2Alpine:v3.16 |
before 2.10.1-r0 | 2.10.1-r0 |
faad2Alpine:v3.17 |
before 2.10.1-r0 | 2.10.1-r0 |
faad2Alpine:v3.18 |
before 2.10.1-r0 | 2.10.1-r0 |
faad2Alpine:v3.19 |
before 2.10.1-r0 | 2.10.1-r0 |
faad2Alpine:v3.20 |
before 2.10.1-r0 | 2.10.1-r0 |
faad2Alpine:v3.21 |
before 2.10.1-r0 | 2.10.1-r0 |
faad2Alpine:v3.22 |
before 2.10.1-r0 | 2.10.1-r0 |
faad2Alpine:v3.23 |
before 2.10.1-r0 | 2.10.1-r0 |
faad2Alpine:v3.24 |
before 2.10.1-r0 | 2.10.1-r0 |
faad2Debian:12 |
before 2.10.0-1 | 2.10.0-1 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
faad2Debian:13 |
before 2.10.0-1 | 2.10.0-1 |
faad2Debian:14 |
before 2.10.0-1 | 2.10.0-1 |
faad2Debian:9 From an advisory covering 7 CVEs |
before 2.8.0~cvs20161113-1+deb9u3, plus listed versions 2.8.0~cvs20161113-12.8.0~cvs20161113-1+deb9u12.8.0~cvs20161113-1+deb9u2 |
2.8.0~cvs20161113-1+deb9u3 |
faad2Debian:10 From an advisory covering 10 CVEs |
before 2.10.0-1~deb10u1, plus listed versions 2.8.8-32.8.8-3+deb10u12.8.8-3.12.8.8-3.22.9.0-12.9.1-12.9.2-1 |
2.10.0-1~deb10u1 |
faad2Ubuntu:Pro:14.04:LTS |
before 2.7-8+deb8u3ubuntu0.1~esm1, plus listed versions 2.7-82.7-8+deb7u1build0.14.04.12.7-8+deb8u3build0.14.04.1~esm1 |
2.7-8+deb8u3ubuntu0.1~esm1 |
faad2Ubuntu:Pro:16.04:LTS |
before 2.8.0~cvs20150510-1ubuntu0.1+esm1, plus listed versions 2.8.0~cvs20150510-12.8.0~cvs20150510-1ubuntu0.1 |
2.8.0~cvs20150510-1ubuntu0.1+esm1 |
faad2Ubuntu:Pro:18.04:LTS |
before 2.8.8-1ubuntu0.1~esm1, plus listed versions 2.8.1-22.8.5-12.8.6-12.8.8-1 |
2.8.8-1ubuntu0.1~esm1 |
faad2Ubuntu:20.04:LTS |
before 2.9.1-1ubuntu0.1, plus listed versions 2.8.8-3.22.9.0-12.9.1-1 |
2.9.1-1ubuntu0.1 |
welle.ioUbuntu:20.04:LTS |
All versions, plus listed versions 2.0~beta2-22.0-22.1-12.1-22.1-2build1 |
None known |
welle.ioUbuntu:22.04:LTS |
All versions, plus listed versions 2.2-12.2-1build1 |
None known |
welle.ioUbuntu:24.04:LTS |
All versions, plus listed versions 2.4+ds-22.4+ds-2build12.4+ds-2build32.4+ds-2build42.4+ds-2build5 |
None known |
welle.ioUbuntu:25.10 |
All versions, plus listed versions 2.4+ds-4 |
None known |
welle.ioUbuntu:26.10 |
All versions, plus listed versions 2.7+ds-12.7+ds-2 |
None known |
welle.ioUbuntu:26.04:LTS |
All versions, plus listed versions 2.4+ds-42.4+ds-4.12.7+ds-1 |
None known |
faad2Ubuntu:Pro:14.04:LTS From an advisory covering 8 CVEs |
before 2.7-8+deb8u3ubuntu0.1~esm1, plus listed versions 2.7-82.7-8+deb7u1build0.14.04.12.7-8+deb8u3build0.14.04.1~esm1 |
2.7-8+deb8u3ubuntu0.1~esm1 |
faad2Ubuntu:Pro:16.04:LTS From an advisory covering 8 CVEs |
before 2.8.0~cvs20150510-1ubuntu0.1+esm1, plus listed versions 2.8.0~cvs20150510-12.8.0~cvs20150510-1ubuntu0.1 |
2.8.0~cvs20150510-1ubuntu0.1+esm1 |
faad2Ubuntu:Pro:18.04:LTS From an advisory covering 8 CVEs |
before 2.8.8-1ubuntu0.1~esm1, plus listed versions 2.8.1-22.8.5-12.8.6-12.8.8-1 |
2.8.8-1ubuntu0.1~esm1 |
faad2Ubuntu:20.04:LTS From an advisory covering 8 CVEs |
before 2.9.1-1ubuntu0.1, plus listed versions 2.8.8-3.22.9.0-12.9.1-1 |
2.9.1-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32276 is a medium vulnerability (CVSS 5.5) in Faad2 Project Faad2, published September 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in faad2 2.10.1-r0.
References
github.com/knik0/faad2/issues/58
lists.debian.org/debian-lts-announce/2021/10/msg00020.html
debian.org/security/2022/dsa-5109
nvd.nist.gov/vuln/detail/CVE-2021-32276
security.alpinelinux.org/vuln/CVE-2021-32276
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2021-32276
ubuntu.com/security/CVE-2021-32276
cve.org/CVERecord?id=CVE-2021-32276