{"id":"CVE-2021-28421","aliases":["EUVD-2021-15100","GHSA-76gm-q7xq-v743","UBUNTU-CVE-2021-28421","openSUSE-SU-2021:0553-1","openSUSE-SU-2021:0570-1"],"status":"rejected","title":"FluidSynth 2.1.7 contains a use after free vulnerability in sfloader/fluid_sffile.c that can...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2021-04-13T13:44:57Z","modified":"2026-02-04T04:38:05Z","fixes":[{"ecosystem":"openSUSE:Leap 15.2","package":"fluidsynth","fixed_in":["1.1.11-lp152.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"fluidsynth","fixed_in":["1.1.11-bp152.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"fluidsynth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.11-lp152.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"fluidsynth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.11-bp152.4.3.1"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28421"},{"url":"https://github.com/FluidSynth/fluidsynth/issues/808","tags":["report"]},{"url":"https://github.com/FluidSynth/fluidsynth/pull/810","tags":["report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00027.html"},{"url":"https://github.com/advisories/GHSA-76gm-q7xq-v743"},{"url":"https://ubuntu.com/security/CVE-2021-28421","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28421","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TNUDR3JYL7FMN2WT7ZNGG6ZC25ZEFXE5/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184705","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28421","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3IQRGNVMOVEAGQCKTOUFZLDHYPRCXEES/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-28421","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2021-04-13T13:44:57Z","modified":"2021-07-13T15:11:43Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-15100","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2021-04-13T13:44:57Z","modified":"2021-07-13T15:11:43Z","updated_at":"2026-11-03T03:51:14.673364Z"}],"ghsa":[{"id":"GHSA-76gm-q7xq-v743","title":"FluidSynth 2.1.7 contains a use after free vulnerability in sfloader/fluid_sffile.c that can...","description":"FluidSynth 2.1.7 contains a use after free vulnerability in sfloader/fluid_sffile.c that can result in arbitrary code execution or a denial of service (DoS) if a malicious soundfont2 file is loaded into a fluidsynth library.","status":"published","published":"2022-05-24T17:47:23Z","modified":"2023-01-29T05:07:15Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:46:09.625645Z"}],"nvd":[{"id":"CVE-2021-28421","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2021-04-13T14:15:14.113Z","modified":"2023-11-07T03:32:08.8Z","updated_at":"2026-11-02T14:06:51.610648Z"}],"osv":[{"id":"UBUNTU-CVE-2021-28421","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-21417. Reason: This candidate is a duplicate of CVE-2021-21417. Notes: All CVE users should reference CVE-2021-21417 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.","status":"withdrawn","published":"2021-04-13T14:15:00Z","modified":"2025-08-01T04:53:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"openSUSE-SU-2021:0553-1","title":"Security update for fluidsynth","description":"This update for fluidsynth fixes the following issues:\n\n- CVE-2021-28421: Fix use after free vulnerability in file loader (boo#1184705)\n","status":"published","published":"2021-04-14T14:51:32Z","modified":"2026-02-04T04:38:05.322353Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0570-1","title":"Security update for fluidsynth","description":"This update for fluidsynth fixes the following issues:\n\n- CVE-2021-28421: Fix use after free vulnerability in file loader (boo#1184705)\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-04-17T22:05:09Z","modified":"2026-02-04T03:48:23.867673Z","updated_at":"2026-11-02T16:58:31.879684Z"}]}}