Every CVE Search/ Get API key

CVE-2021-3549

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could...

7.1 HighFix available

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.97%Up 0.6 points since May 27, 2021
90%50%10%1%

What each source reports

NVD Score used 7.1

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

Record
CVE-2021-3549
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:N/I:P/A:P
Weakness
CWE-119, CWE-787
Updated
2026-11-02
CVE List No score

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

Record
CVE-2021-3549
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2021-26860 0.0

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

Record
EUVD-2021-26860
CVSS
0.0 NoneCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-p2w9-g2w7-8fw9 7.1

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could...

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

Record
GHSA-p2w9-g2w7-8fw9
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness
CWE-119, CWE-787
Updated
2026-11-02
OSV 7.1

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

Record
CVE-2021-3549
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3549 7.1

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

Record
DEBIAN-CVE-2021-3549
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1242 7.1

binutils security update

The GNU Binutils are a collection of binary tools.

Security Fix(es):

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.(CVE-2021-3549)

Record
OESA-2021-1242
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3549 7.1

An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system availability.

Record
UBUNTU-CVE-2021-3549
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
binutils
Debian:12
 before 2.37-3
2.37-3
binutils
Debian:13
 before 2.37-3
2.37-3
binutils
Debian:14
 before 2.37-3
2.37-3
binutils
openEuler:20.03-LTS-SP1
 before 2.34-11.oe1
2.34-11.oe1
binutils
Ubuntu:22.04:LTS
 before 2.37-7ubuntu1
2.37-7ubuntu1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3549 is a high vulnerability (CVSS 7.1) in Gnu Binutils, published May 26, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in binutils 2.37-3.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open