{"id":"CVE-2021-21772","aliases":["DEBIAN-CVE-2021-21772","DSA-4887-1","EUVD-2021-8944","GHSA-6f4r-f2fv-g8f4","MGASA-2021-0368","UBUNTU-CVE-2021-21772","USN-6216-1"],"status":"published","title":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality...","description":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0417,"percentile":0.90977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2021-03-10T00:00:00Z","modified":"2026-10-24T10:30:58Z","exploits":[{"source":"pocgithub","id":"3dluvr/New-lib3mf.dll-for-MeshMixer","title":"3dluvr/New-lib3mf.dll-for-MeshMixer","date":"2024-12-31","url":"https://github.com/3dluvr/New-lib3mf.dll-for-MeshMixer"}],"fixes":[{"ecosystem":"Debian:12","package":"lib3mf","fixed_in":["1.8.1+ds-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lib3mf","fixed_in":["1.8.1+ds-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lib3mf","fixed_in":["1.8.1+ds-4"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"lib3mf","fixed_in":["1.8.1+ds-3+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"lib3mf","fixed_in":["2.1.1-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"act","fixed_in":["1.6.0-4.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"openscad","fixed_in":["2021.01-1.2.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"lib3mf","fixed_in":["1.8.1+ds-3ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lib3mf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1+ds-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lib3mf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1+ds-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lib3mf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1+ds-4"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"lib3mf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1+ds-3+deb10u1"}]}],"versions":["1.8.1+ds-3"]},{"source":"osv","ecosystem":"Mageia:8","package":"lib3mf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"act","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-4.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"openscad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-1.2.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lib3mf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1+ds-3ubuntu0.2"}]}],"versions":["1.8.1+ds-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lib3mf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1+ds-3ubuntu0.2"}]}],"versions":["1.8.1+ds-3"]}],"products":[{"vendor":"3mf","product":"lib3mf"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2020-1226","tags":["x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WDGGB65YBQL662M3MOBNNJJNRNURW4TG/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHMMHD2EOMIVJ7EKZTJJMX4C7E6ZRWDL/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPBS642OYVA6DUKK3HZHEINVWEDZSMEU/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://www.debian.org/security/2021/dsa-4887","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-01","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1226","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21772"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMMHD2EOMIVJ7EKZTJJMX4C7E6ZRWDL/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPBS642OYVA6DUKK3HZHEINVWEDZSMEU/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WDGGB65YBQL662M3MOBNNJJNRNURW4TG/"},{"url":"https://github.com/advisories/GHSA-6f4r-f2fv-g8f4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21772","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0368.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29018","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WDGGB65YBQL662M3MOBNNJJNRNURW4TG/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-21772","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6216-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21772","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-21772","description":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-03-10T00:00:00Z","modified":"2024-08-03T18:23:29.264Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-8944","description":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-03-10T00:00:00Z","modified":"2024-08-03T18:23:29Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:05.131984Z"}],"ghsa":[{"id":"GHSA-6f4r-f2fv-g8f4","title":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality...","description":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2022-05-24T17:44:13Z","modified":"2023-01-28T05:07:40Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:44:33.554453Z"}],"nvd":[{"id":"CVE-2021-21772","description":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-03-10T17:15:15.113Z","modified":"2026-06-17T03:36:05.52Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"CVE-2021-21772","description":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-03-10T17:15:15.113Z","modified":"2026-10-24T10:30:58.19080202Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-21772","description":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-03-10T17:15:15.113Z","modified":"2026-10-23T18:03:25.155183491Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-21772","description":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.","status":"published","published":"2021-03-10T17:15:00Z","modified":"2026-04-22T12:46:49.282128Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"DSA-4887-1","title":"lib3mf - security update","status":"published","published":"2021-04-08T00:00:00Z","modified":"2026-03-09T02:08:49.297912Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0368","title":"Updated lib3mf packages fix security vulnerability","description":"A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP()\nfunctionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can\nlead to code execution. An attacker can provide a malicious file to trigger\nthis vulnerability (CVE-2021-21772).\n\nA new package 'act' is introduced to build newer version of lib3mf.\n\nAlso, openscad is rebuilt against this updated library.\n","status":"published","published":"2021-07-25T08:34:17Z","modified":"2026-04-16T04:41:35.957527304Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"USN-6216-1","title":"lib3mf vulnerability","description":"It was discovered that lib3mf did not properly manage memory under \ncertain circumstances. If a user were tricked into opening a specially \ncrafted 3MF file, a local attacker could possibly use this issue to \ncause applications using lib3mf to crash, resulting in a denial of \nservice, or possibly execute arbitrary code.\n","status":"published","published":"2023-07-11T16:36:18Z","modified":"2026-04-22T10:36:33.408731Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}