CVE-2021-37322
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component...
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
- Record
CVE-2021-37322- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
- Record
CVE-2021-37322- Updated
- 2026-11-02
EUVDEUVD-2021-23891 No score
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
- Record
EUVD-2021-23891- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6f99-ppjg-wgj7 No score
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component...
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
- Record
GHSA-6f99-ppjg-wgj7- Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
- Record
CVE-2021-37322- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-37322
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
- Record
DEBIAN-CVE-2021-37322- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-37322
GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.
- Record
UBUNTU-CVE-2021-37322- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
binutilsDebian:12 |
before 2.27.51.20161102-1 | 2.27.51.20161102-1 |
binutilsDebian:13 |
before 2.27.51.20161102-1 | 2.27.51.20161102-1 |
binutilsDebian:14 |
before 2.27.51.20161102-1 | 2.27.51.20161102-1 |
binutilsUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.23.52.20130913-0ubuntu12.23.90.20131017-1ubuntu12.23.90.20131116-1ubuntu12.23.91.20131123-1ubuntu12.24-1ubuntu1 Show 20 moreShow less2.24-1ubuntu22.24-2ubuntu12.24-2ubuntu22.24-2ubuntu32.24-4ubuntu12.24-5ubuntu12.24-5ubuntu22.24-5ubuntu32.24-5ubuntu3.12.24-5ubuntu132.24-5ubuntu142.24-5ubuntu14.12.24-5ubuntu14.22.24-5ubuntu14.2+esm12.24-5ubuntu14.2+esm22.24-5ubuntu14.2+esm32.24-5ubuntu14.2+esm52.24-5ubuntu14.2+esm62.24-5ubuntu14.2+esm72.24-5ubuntu14.2+esm8 |
None known |
binutilsUbuntu:Pro:16.04:LTS |
before 2.26.1-1ubuntu1~16.04.8+esm1, plus listed versions 2.25.1-6ubuntu12.25.51.20151022-0ubuntu22.25.51.20151022-0ubuntu32.25.51.20151027-0ubuntu12.25.51.20151028-0ubuntu1 Show 26 moreShow less2.25.51.20151106-0ubuntu12.25.51.20151113-1ubuntu12.25.51.20151113-2ubuntu12.25.90.20151125-1ubuntu12.25.90.20151125-2ubuntu12.25.90.20151211-0ubuntu12.25.90.20151211-0ubuntu22.25.90.20160101-1ubuntu12.25.90.20160101-1ubuntu22.26-2ubuntu12.26-3ubuntu12.26-4ubuntu12.26-5ubuntu12.26-6ubuntu12.26-7ubuntu22.26-8ubuntu12.26-8ubuntu22.26-8ubuntu2.12.26.1-1ubuntu1~16.042.26.1-1ubuntu1~16.04.12.26.1-1ubuntu1~16.04.32.26.1-1ubuntu1~16.04.42.26.1-1ubuntu1~16.04.52.26.1-1ubuntu1~16.04.62.26.1-1ubuntu1~16.04.72.26.1-1ubuntu1~16.04.8 |
2.26.1-1ubuntu1~16.04.8+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37322 is a high vulnerability (CVSS 7.8) in Gnu Gcc, published November 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in binutils 2.27.51.20161102-1.