CVE-2021-38714

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary...

8.8 HighFix available

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.84%Up 2.1 points since Aug 25, 2021

What each source reports

NVD Score used 8.8

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

Record: CVE-2021-38714
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-190
Updated: 2026-11-02

CVE List No score

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

Record: CVE-2021-38714
Updated: 2026-11-02

EUVDEUVD-2021-25151 No score

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

Record: EUVD-2021-25151
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8593-h9pq-2qm4 8.8

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary...

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

Record: GHSA-8593-h9pq-2qm4
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSV 8.8

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

Record: CVE-2021-38714
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-38714 8.8

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

Record: DEBIAN-CVE-2021-38714
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2021-38714 8.8

In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

Record: UBUNTU-CVE-2021-38714
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2021-0476 No score

Updated plib packages fix security vulnerability

Integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.

Record: MGASA-2021-0476
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11600-1 No score

libplib0-1.8.5+svn.2173-6.1 on GA media

These are all security issues fixed in the libplib0-1.8.5+svn.2173-6.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11600-1
Updated: 2026-11-02

OSVUSN-6353-1 No score

plib vulnerability

Wooseok Kang discovered that PLIB did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted TGA file, an attacker could possibly use this issue to cause applications using PLIB to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record: USN-6353-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`plib` Debian:12	before 1.8.5-10	1.8.5-10
`plib` Debian:13	before 1.8.5-10	1.8.5-10
`plib` Debian:14	before 1.8.5-10	1.8.5-10
`plib` Debian:9	before 1.8.5-7+deb9u1, plus listed versions 1.8.5-7	1.8.5-7+deb9u1
`plib` Mageia:8	before 1.8.5-13.1.mga8	1.8.5-13.1.mga8
`plib` Ubuntu:Pro:16.04:LTS	before 1.8.5-7ubuntu0.1~esm1, plus listed versions 1.8.5-7	1.8.5-7ubuntu0.1~esm1
`plib` Ubuntu:Pro:18.04:LTS	before 1.8.5-8ubuntu0.18.04.1~esm1, plus listed versions 1.8.5-8	1.8.5-8ubuntu0.18.04.1~esm1
`plib` Ubuntu:20.04:LTS	before 1.8.5-8ubuntu0.20.04.1, plus listed versions 1.8.5-8build11.8.5-8build2	1.8.5-8ubuntu0.20.04.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-38714 is a high vulnerability (CVSS 8.8) in Plib Project Plib, published August 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.84%, the 86th percentile. Fixed in plib 1.8.5-10.

References

Show 12 moreShow less