CVE-2021-36489
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of...
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
- Record
CVE-2021-36489- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
- Record
CVE-2021-36489- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2021-23091
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
- Record
EUVD-2021-23091- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-79jf-r7mw-w7h5
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of...
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
- Record
GHSA-79jf-r7mw-w7h5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
- Record
CVE-2021-36489- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-36489
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
- Record
DEBIAN-CVE-2021-36489- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-36489
Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon.
- Record
UBUNTU-CVE-2021-36489- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
allegro4.4Debian:12 | All versions, plus listed versions 2:4.4.3.1-32:4.4.3.1-42:4.4.3.1-4.12:4.4.3.1-4.1~exp12:4.4.3.1-4.1~exp2 Show 5 moreShow less2:4.4.3.1-52:4.4.3.1-62:4.4.3.1-72:4.4.3.1-82:4.4.3.1-9 | None known |
allegro4.4Debian:13 | All versions, plus listed versions 2:4.4.3.1-52:4.4.3.1-62:4.4.3.1-72:4.4.3.1-82:4.4.3.1-9 | None known |
allegro4.4Debian:14 | before 2:4.4.3.1-8, plus listed versions 2:4.4.3.1-52:4.4.3.1-62:4.4.3.1-7 | 2:4.4.3.1-8 |
allegro5Debian:12 | before 2:5.2.8.0-1 | 2:5.2.8.0-1 |
allegro5Debian:13 | before 2:5.2.8.0-1 | 2:5.2.8.0-1 |
allegro5Debian:14 | before 2:5.2.8.0-1 | 2:5.2.8.0-1 |
allegro5Ubuntu:16.04:LTS | All versions, plus listed versions 2:5.0.11-12:5.0.11-2 | None known |
allegro5Ubuntu:18.04:LTS | All versions, plus listed versions 2:5.2.2-12:5.2.3.0-1 | None known |
allegro5Ubuntu:20.04:LTS | All versions, plus listed versions 2:5.2.5.0-22:5.2.5.0-32:5.2.6.0-1 | None known |
allegro5Ubuntu:22.04:LTS | All versions, plus listed versions 2:5.2.6.0-32:5.2.7.0-12:5.2.7.0-1build1 | None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
allegro5Ubuntu:24.04:LTS | All versions, plus listed versions 2:5.2.8.0+dfsg-12:5.2.8.0+dfsg-22:5.2.9.0+dfsg-12:5.2.9.1+dfsg-12:5.2.9.1+dfsg-1.1build32:5.2.9.1+dfsg-1.1build4 | None known |
allegro5Ubuntu:25.10 | All versions, plus listed versions 2:5.2.10.1+dfsg-1build1 | None known |
allegro5Ubuntu:26.10 | All versions, plus listed versions 2:5.2.11.3+dfsg-1 | None known |
allegro5Ubuntu:26.04:LTS | All versions, plus listed versions 2:5.2.10.1+dfsg-1build12:5.2.10.1+dfsg-32:5.2.10.1+dfsg-3build12:5.2.11.0+dfsg-12:5.2.11.2+dfsg-12:5.2.11.3+dfsg-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36489 is a medium vulnerability (CVSS 6.5) in Liballeg Allegro, published February 3, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in allegro4.4 2:4.4.3.1-8.