Every CVE Search/ Get API key

CVE-2021-34121

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this...

7.8 HighFix available

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.34%Up 0.3 points since Jul 19, 2023
90%50%10%1%

What each source reports

NVD Score used 7.8

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.

Record
CVE-2021-34121
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.

Record
CVE-2021-34121
Updated
2026-11-02
EUVDEUVD-2021-20784 No score

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.

Record
EUVD-2021-20784
Updated
2026-11-03
GitHub AdvisoriesGHSA-vvmp-35v7-f6q6 7.8

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this...

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.

Record
GHSA-vvmp-35v7-f6q6
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 7.8

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.

Record
CVE-2021-34121
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-34121 7.8

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.

Record
DEBIAN-CVE-2021-34121
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-34121 7.8

An Out of Bounds flaw was discovered in htmodoc 1.9.12 in function parse_tree() in toc.cxx, this possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.

Record
UBUNTU-CVE-2021-34121
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-7189-1 No score

HTMLDOC vulnerabilities

It was discovered that HTMLDOC incorrectly handled certain inputs, which could lead to an integer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-20308)

It was discovered that HTMLDOC incorrectly handled memory in pspdf_export, which could lead to a double-free. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-23158)

It was discovered that HTMLDOC incorrectly handled memory when loading a JPEG image, which could lead to a NULL pointer dereference. An attacker could potentially use this issue to cause a denial of service. (CVE-2021-23191, CVE-2021-26948)

It was discovered that HTMLDOC incorrectly handled certain inputs, which could lead to a stack buffer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-23206, CVE-2021-40985, CVE-2021-43579)

It was discovered that HTMLDOC incorrectly handled memory in pdpdf_prepare_page and render_table_row, which could lead to a heap buffer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-26252, CVE-2021-26259)

It was discovered that HTMLDOC incorrectly handled memory in parse_paragraph, which could lead to a heap buffer overflow. An attacker could potentially use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34119)

It was discovered that HTMLDOC incorrectly handled memory in parse_tree. An attacker could potentially use this issue to leak sensitive information. (CVE-2021-34121)

Record
USN-7189-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
htmldoc
Debian:12
 before 1.9.13-1
1.9.13-1
htmldoc
Debian:13
 before 1.9.13-1
1.9.13-1
htmldoc
Debian:14
 before 1.9.13-1
1.9.13-1
htmldoc
Ubuntu:Pro:14.04:LTS
 before 1.8.27-8ubuntu1+esm3, plus listed versions
1.8.27-8ubuntu11.8.27-8ubuntu1+esm11.8.27-8ubuntu1+esm2
1.8.27-8ubuntu1+esm3
htmldoc
Ubuntu:Pro:16.04:LTS
 before 1.8.27-8ubuntu1.1+esm2, plus listed versions
1.8.27-8ubuntu11.8.27-8ubuntu1.11.8.27-8ubuntu1.1+esm1
1.8.27-8ubuntu1.1+esm2
htmldoc
Ubuntu:Pro:18.04:LTS
 before 1.9.2-1ubuntu0.2+esm1, plus listed versions
1.8.27-8ubuntu21.8.27-8ubuntu31.9.2-11.9.2-1ubuntu0.11.9.2-1ubuntu0.2
1.9.2-1ubuntu0.2+esm1
htmldoc
Ubuntu:Pro:20.04:LTS
 before 1.9.7-1ubuntu0.3+esm1, plus listed versions
1.9.3-11.9.7-11.9.7-1build11.9.7-1ubuntu0.21.9.7-1ubuntu0.3
1.9.7-1ubuntu0.3+esm1
htmldoc
Ubuntu:Pro:14.04:LTS
From an advisory covering 11 CVEs
 before 1.8.27-8ubuntu1+esm3, plus listed versions
1.8.27-8ubuntu11.8.27-8ubuntu1+esm11.8.27-8ubuntu1+esm2
1.8.27-8ubuntu1+esm3
htmldoc
Ubuntu:Pro:16.04:LTS
From an advisory covering 11 CVEs
 before 1.8.27-8ubuntu1.1+esm2, plus listed versions
1.8.27-8ubuntu11.8.27-8ubuntu1.11.8.27-8ubuntu1.1+esm1
1.8.27-8ubuntu1.1+esm2
htmldoc
Ubuntu:Pro:18.04:LTS
From an advisory covering 11 CVEs
 before 1.9.2-1ubuntu0.2+esm1, plus listed versions
1.8.27-8ubuntu21.8.27-8ubuntu31.9.2-11.9.2-1ubuntu0.11.9.2-1ubuntu0.2
1.9.2-1ubuntu0.2+esm1
htmldoc
Ubuntu:Pro:20.04:LTS
From an advisory covering 11 CVEs
 before 1.9.7-1ubuntu0.3+esm1, plus listed versions
1.9.3-11.9.7-11.9.7-1build11.9.7-1ubuntu0.21.9.7-1ubuntu0.3
1.9.7-1ubuntu0.3+esm1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-34121 is a high vulnerability (CVSS 7.8) in Htmldoc Project Htmldoc, published July 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in htmldoc 1.9.13-1.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open