{"id":"CVE-2021-25829","aliases":["EUVD-2021-12712","GHSA-jmxf-5qxj-85w9"],"status":"published","title":"An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE...","description":"An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07445,"percentile":0.94496,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2021-03-01T15:07:19Z","modified":"2026-10-20T10:53:39Z","products":[{"vendor":"onlyoffice","product":"document_server"}],"references":[{"url":"https://github.com/ONLYOFFICE/DocumentServer","tags":["x_refsource_MISC","x_transferred","Product","package"]},{"url":"https://github.com/ONLYOFFICE/core","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory","package"]},{"url":"https://github.com/ONLYOFFICE/core/blob/v5.6.4.10/ASCOfficePPTXFile/Editor/BinaryFileReaderWriter.cpp#L1722","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Comments.h#L299","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Core.h#L161","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/NotesMaster.h#L148","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/NotesSlide.h#L141","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Presentation.h#L277","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/ONLYOFFICE/core/blob/c1e4a2ce33bdcfab29d670f5fdb10fc63cf5fd6a/ASCOfficePPTXFile/PPTXFormat/Theme.h#L277","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/merrychap/poc_exploits/tree/master/ONLYOFFICE/CVE-2021-25829","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25829"},{"url":"https://github.com/advisories/GHSA-jmxf-5qxj-85w9"}],"sources":{"cve":[{"id":"CVE-2021-25829","description":"An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.","status":"published","published":"2021-03-01T15:07:19Z","modified":"2024-08-03T20:11:28.491Z","updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2021-12712","description":"An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.","status":"published","published":"2021-03-01T15:07:19Z","modified":"2024-08-03T20:11:28Z","updated_at":"2026-11-03T03:24:52.420769Z"}],"ghsa":[{"id":"GHSA-jmxf-5qxj-85w9","title":"An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE...","description":"An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.","status":"published","published":"2022-05-24T17:43:24Z","modified":"2023-01-29T05:05:53Z","updated_at":"2026-11-02T14:45:54.221809Z"}],"nvd":[{"id":"CVE-2021-25829","description":"An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.","status":"published","published":"2021-03-01T16:15:14.15Z","modified":"2026-06-17T03:42:29.107Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:50.399901Z"}],"osv":[{"id":"CVE-2021-25829","description":"An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. Using this bug, an attacker is able to produce a denial of service attack that can eventually shut down the target server.","status":"published","published":"2021-03-01T16:15:14.15Z","modified":"2026-10-20T10:53:39.786851507Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.778776Z"}]}}