CVE-2021-36977

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in...

6.5 Medium

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.50%Up 0.9 points since Jul 20, 2021

What each source reports

NVD Score used 6.5

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.

Record: CVE-2021-36977
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.

Record: CVE-2021-36977
Updated: 2026-11-02

EUVDEUVD-2021-23553 No score

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.

Record: EUVD-2021-23553
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jc5x-q9q8-4xhc 6.5

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in...

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry).

Record: GHSA-jc5x-q9q8-4xhc
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 6.5

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.

Record: CVE-2021-36977
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-36977 6.5

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.

Record: UBUNTU-CVE-2021-36977
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2022-0465 No score

Updated matio packages fix security vulnerability

matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4). (CVE-2020-36428)

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0. (CVE-2021-36977)

Record: MGASA-2022-0465
Updated: 2026-11-02

OSVopenSUSE-SU-2022:10235-1 No score

Security update for matio

This update for matio fixes the following issues:

Update to version 1.5.23:

Fixed testsuite regression from version 1.5.22.

Changes from version 1.5.22:

Added support for reading large MAT file.
Updated cmake-conan to version 0.17.0.
Fixed CMake build with Conan (MATIO_USE_CONAN:BOOL=ON).
Fixed data type when reading 16-bit character data from HDF5 MAT file.
Fixed heap-based buffer overflows when reading (crafted) MAT file (CVE-2020-36428, CVE-2021-36977).
Confirmed compatibility with HDF5 v1.13.0 and v1.13.1.
Several other fixes, for example for memory leaks.

Record: openSUSE-SU-2022:10235-1
Updated: 2026-11-02

Affected products

matio project matio

Affected packages

Affected packages
Package	Affected	Fixed
`matio` Mageia:8 From an advisory covering 2 CVEs	before 1.5.23-1.mga8	1.5.23-1.mga8
`libmatio` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.5.19-21.5.21-11.5.21-1ubuntu0.1~esm1	None known
`matio` SUSE:Package Hub 15 SP4 From an advisory covering 2 CVEs	before 1.5.23-bp154.2.3.1	1.5.23-bp154.2.3.1
`matio` openSUSE:Leap 15.4 From an advisory covering 2 CVEs	before 1.5.23-bp154.2.3.1	1.5.23-bp154.2.3.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-36977 is a medium vulnerability (CVSS 6.5) in Matio Project Matio, published July 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. No source names a fixed version.

References

Show 10 moreShow less