CVE-2021-39282

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

7.5 HighFix available

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.53%Up 0.9 points since Aug 19, 2021

What each source reports

NVD Score used 7.5

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

Record: CVE-2021-39282
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-401
Updated: 2026-11-02

CVE List No score

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

Record: CVE-2021-39282
Updated: 2026-11-02

EUVDEUVD-2021-25644 No score

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

Record: EUVD-2021-25644
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3x73-wm98-jh2g 7.5

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

Record: GHSA-3x73-wm98-jh2g
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-401, CWE-772
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-39282 7.5

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

Record: DEBIAN-CVE-2021-39282
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-39282 7.5

Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.

Record: UBUNTU-CVE-2021-39282
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11023-1 No score

libBasicUsageEnvironment1-2021.08.23-1.2 on GA media

These are all security issues fixed in the libBasicUsageEnvironment1-2021.08.23-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11023-1
Updated: 2026-11-02

Affected products

live555

Affected packages

Affected packages
Package	Affected	Fixed
`liblivemedia` Debian:14	before 2026.09.23-dfsg-1, plus listed versions 2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1 Show 45 moreShow less 2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-12014.01.13-12015.12.22-12016.01.12-12016.01.16-12016.01.20-12016.01.29-12016.01.29-2	2026.09.23-dfsg-1
`liblivemedia` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2014.01.13-12016.01.29-22016.02.09-12016.02.09-1ubuntu0.1~esm1	None known
`liblivemedia` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2017.07.18-12017.09.12-1ubuntu12017.10.28-22018.01.29-12018.02.18-12018.02.18-1ubuntu0.1~esm1	None known
`liblivemedia` Ubuntu:20.04:LTS	All versions, plus listed versions 2018.11.26-1.12020.01.19-12020.01.19-1build1	None known
`liblivemedia` Ubuntu:26.10	All versions, plus listed versions 2026.09.23-dfsg-12026.09.23-dfsg-32026.09.23-dfsg-4	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-39282 is a high vulnerability (CVSS 7.5) in Live555, published August 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. Fixed in liblivemedia 2026.09.23-dfsg-1.

References

Show 12 moreShow less

This page doesn't list everything

Left out here: 52 versions. The JSON record has them.