{"id":"CVE-2021-3782","aliases":["ALSA-2023:2786","AZL-11019","BELL-CVE-2021-3782","DEBIAN-CVE-2021-3782","EUVD-2021-27046","GHSA-pvw2-9h4r-c5cr","JLSEC-2026-97","MGASA-2022-0418","OESA-2022-1920","RHSA-2023:2786","RLSA-2023:2786","SUSE-SU-2023:1860-1","SUSE-SU-2023:1864-1","SUSE-SU-2023:1873-1","SUSE-SU-2023:1874-1","UBUNTU-CVE-2021-3782","USN-5614-1","USN-5614-2"],"status":"published","title":"An internal reference count is held on the buffer pool, incremented every time a new buffer is...","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00317,"percentile":0.24971,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2022-08-30T20:51:00Z","modified":"2026-10-29T11:02:04Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"libwayland-client","fixed_in":["1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libwayland-cursor","fixed_in":["1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libwayland-egl","fixed_in":["1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libwayland-server","fixed_in":["1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"wayland-devel","fixed_in":["1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"wayland","fixed_in":["1.21.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wayland","fixed_in":["1.21.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wayland","fixed_in":["1.21.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wayland","fixed_in":["1.21.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Wayland_jll","fixed_in":["1.21.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"wayland","fixed_in":["1.18.0-3.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"wayland","fixed_in":["1.17.0-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"wayland","fixed_in":["1.17.0-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"wayland","fixed_in":["1.19.91-4.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-client","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-client-debuginfo","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-cursor","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-cursor-debuginfo","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-egl","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-egl-debuginfo","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-server","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-server-debuginfo","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland-debuginfo","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland-debugsource","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland-devel","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland-devel-debuginfo","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"wayland","fixed_in":["0:1.21.0-1.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"wayland","fixed_in":["1.19.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"wayland","fixed_in":["1.19.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"wayland","fixed_in":["1.19.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"wayland","fixed_in":["1.19.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"wayland","fixed_in":["1.19.0-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"wayland","fixed_in":["1.13.0-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"wayland","fixed_in":["1.13.0-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"wayland","fixed_in":["1.13.0-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"wayland","fixed_in":["1.18.0-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"wayland","fixed_in":["1.16.0-150100.7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"wayland","fixed_in":["1.16.0-150100.7.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"wayland","fixed_in":["1.16.0-150100.7.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wayland","fixed_in":["1.12.0-1~ubuntu16.04.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"wayland","fixed_in":["1.16.0-1ubuntu1.1~18.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"wayland","fixed_in":["1.18.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"wayland","fixed_in":["1.20.0-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwayland-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwayland-cursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwayland-egl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libwayland-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"wayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"Wayland_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-3.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.91-4.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-cursor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-cursor-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-egl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-egl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libwayland-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"wayland-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.21.0-1.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150100.7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150100.7.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150100.7.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1~ubuntu16.04.3+esm1"}]}],"versions":["1.8.1-1","1.9.0-1","1.12.0-1~ubuntu16.04.1","1.12.0-1~ubuntu16.04.2","1.12.0-1~ubuntu16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1ubuntu1.1~18.04.4"}]}],"versions":["1.14.0-1","1.14.0-2","1.16.0-1ubuntu1.1~18.04.1","1.16.0-1ubuntu1.1~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1ubuntu0.1"}]}],"versions":["1.17.0-1","1.17.0-1build1","1.17.0-1build2","1.18.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-1ubuntu0.1"}]}],"versions":["1.19.0-2build1","1.20.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-1ubuntu1.1~18.04.4"}]}],"versions":["1.14.0-1","1.14.0-2","1.16.0-1ubuntu1.1~18.04.1","1.16.0-1ubuntu1.1~18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-1ubuntu0.1"}]}],"versions":["1.17.0-1","1.17.0-1build1","1.17.0-1build2","1.18.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-1ubuntu0.1"}]}],"versions":["1.19.0-2build1","1.20.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"wayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-1~ubuntu16.04.3+esm1"}]}],"versions":["1.8.1-1","1.9.0-1","1.12.0-1~ubuntu16.04.1","1.12.0-1~ubuntu16.04.2","1.12.0-1~ubuntu16.04.3"]}],"products":[{"vendor":"microsoft","product":"wayland"},{"vendor":"wayland","product":"wayland"}],"references":[{"url":"https://gitlab.freedesktop.org/wayland/wayland/-/issues/224","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3782","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pvw2-9h4r-c5cr"},{"url":"https://access.redhat.com/errata/RHSA-2023:2786","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3782","tags":["report"]},{"url":"https://bugzilla.redhat.com/2002627","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-2786.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-3782","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3782","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0418.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30855","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5614-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1920","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002627","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2137625","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2786.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3782","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2023:2786","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231860-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190486","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3782","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231864-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231873-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231874-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3782","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5614-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3782","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","status":"published","published":"2022-09-23T15:26:59Z","modified":"2025-05-22T18:21:26.824Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-27046","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","status":"published","published":"2022-09-23T15:26:59Z","modified":"2025-05-22T18:21:26Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T20:32:39.867081Z"}],"ghsa":[{"id":"GHSA-pvw2-9h4r-c5cr","title":"An internal reference count is held on the buffer pool, incremented every time a new buffer is...","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","status":"published","published":"2022-09-25T00:00:20Z","modified":"2023-06-01T18:30:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:54:37.773458Z"}],"nvd":[{"id":"CVE-2021-3782","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","status":"published","published":"2022-09-23T16:15:10.143Z","modified":"2026-06-17T04:05:45.153Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"AZL-11019","title":"CVE-2021-3782 affecting package wayland for versions less than 1.21.0-1","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","status":"published","published":"2022-09-23T16:15:10Z","modified":"2026-04-21T04:21:45.656386Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"BELL-CVE-2021-3782","title":"CVE-2021-3782 does not affect BellSoft software","status":"withdrawn","published":"2022-09-23T16:15:00Z","modified":"2026-01-26T09:45:56.793225Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-3782","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","status":"published","published":"2022-09-23T16:15:10.143Z","modified":"2026-10-20T10:54:52.248053222Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-3782","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","status":"published","published":"2022-09-23T16:15:10.143Z","modified":"2026-10-23T18:03:31.011513901Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"JLSEC-2026-97","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of `wl_shm` buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the `wl_shm_pool` tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","status":"published","published":"2026-04-14T12:58:25.609Z","modified":"2026-07-25T18:24:56.58949953Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:19.003546Z"},{"id":"OESA-2022-1920","title":"wayland security update","description":"Wayland is a protocol for a compositor to talk to its clients as well as a C library implementation of that protocol. The compositor can be a standalone display server running on Linux kernel modesetting and evdev input devices, an X application, or a wayland client itself. The clients can be traditional applications, X servers (rootless or fullscreen) or other display servers. Part of the Wayland project is also the Weston reference implementation of a Wayland compositor. Weston can run as an X client or under Linux KMS and ships with a few demo clients. The Weston compositor is a minimal and fast compositor and is suitable for many embedded and mobile use cases.\r\n\r\nSecurity Fix(es):\r\n\r\nAn internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.(CVE-2021-3782)","status":"published","published":"2022-09-16T11:05:14Z","modified":"2026-08-18T01:17:18.591660022Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHSA-2023:2786","title":"Red Hat Security Advisory: wayland security, bug fix, and enhancement update","status":"published","published":"2024-09-16T09:36:04Z","modified":"2026-06-27T10:17:05Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RLSA-2023:2786","title":"Moderate: wayland security, bug fix, and enhancement update","description":"Wayland is a protocol for a compositor to talk to its clients, as well as a C library implementation of that protocol. The compositor can be a standalone display server running on Linux kernel modesetting and evdev input devices, an X application, or a wayland client itself. The clients can be traditional applications, X servers (rootless or fullscreen) or other display servers.\n\nThe following packages have been upgraded to a later upstream version: wayland (1.21.0). (BZ#2137625)\n\nSecurity Fix(es):\n\n* wayland: libwayland-server wl_shm reference-count overflow (CVE-2021-3782)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.","status":"published","published":"2026-06-27T00:01:04.193077Z","modified":"2026-06-27T00:30:03.768412387Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2021-3782","description":"An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.","status":"published","published":"2022-08-30T20:51:00Z","modified":"2026-04-22T12:58:48.478322Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"ALSA-2023:2786","title":"Moderate: wayland security, bug fix, and enhancement update","description":"Wayland is a protocol for a compositor to talk to its clients, as well as a C library implementation of that protocol. The compositor can be a standalone display server running on Linux kernel modesetting and evdev input devices, an X application, or a wayland client itself. The clients can be traditional applications, X servers (rootless or fullscreen) or other display servers.\n\nThe following packages have been upgraded to a later upstream version: wayland (1.21.0). (BZ#2137625)\n\nSecurity Fix(es):\n\n* wayland: libwayland-server wl_shm reference-count overflow (CVE-2021-3782)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-16T00:00:00Z","modified":"2026-10-29T11:02:04.370136938Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"MGASA-2022-0418","title":"Updated wayland packages fix security vulnerability","description":"An internal reference count is held on the buffer pool, incremented every\ntime a new buffer is created from the pool. The reference count is\nmaintained as an int; on LP64 systems this can cause the reference count\nto overflow if the client creates a large number of wl_shm buffer objects,\nor if it can coerce the server to create a large number of external\nreferences to the buffer storage. With the reference count overflowing, a\nuse-after-free can be constructed on the wl_shm_pool tracking structure,\nwhere values may be incremented or decremented; it may also be possible to\nconstruct a limited oracle to leak 4 bytes of server-side memory to the\nattacking client at a time. (CVE-2021-3782)\n","status":"published","published":"2022-11-13T02:25:20Z","modified":"2026-04-16T04:42:48.033802804Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"SUSE-SU-2023:1860-1","title":"Security update for wayland","description":"This update for wayland fixes the following issues:\n\n- CVE-2021-3782: Fixed a reference-count overflow in libwayland-server SHM handling. (bsc#1190486)\n","status":"published","published":"2023-04-14T15:36:16Z","modified":"2025-05-02T04:31:43.154726Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1864-1","title":"Security update for wayland","description":"This update for wayland fixes the following issues:\n\n- CVE-2021-3782: Fixed a reference-count overflow in libwayland-server SHM handling. (bsc#1190486)\n","status":"published","published":"2023-04-17T08:57:19Z","modified":"2026-02-04T03:00:02.779314Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1873-1","title":"Security update for wayland","description":"This update for wayland fixes the following issues:\n\n- CVE-2021-3782: Fixed a reference-count overflow in libwayland-server SHM handling. (bsc#1190486)\n","status":"published","published":"2023-04-18T04:28:35Z","modified":"2026-02-04T02:24:37.345334Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1874-1","title":"Security update for wayland","description":"This update for wayland fixes the following issues:\n\n- CVE-2021-3782: Fixed a reference-count overflow in libwayland-server SHM handling. (bsc#1190486)\n","status":"published","published":"2023-04-18T04:28:59Z","modified":"2026-02-04T04:26:12.283256Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"USN-5614-1","title":"wayland vulnerability","description":"It was discovered that Wayland incorrectly handled reference counting\ncertain objects. An attacker could use this issue to cause Wayland to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode.\n","status":"published","published":"2022-09-15T16:43:06Z","modified":"2026-04-22T10:27:10.74459Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5614-2","title":"wayland vulnerability","description":"USN-5614-1 fixed a vulnerability in Wayland. This update\nprovides the corresponding update for Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Wayland incorrectly handled reference counting\n certain objects. An attacker could use this issue to cause Wayland to\n crash, resulting in a denial of service, or possibly execute arbitrary\n code.\n","status":"published","published":"2022-10-03T17:26:02Z","modified":"2026-06-25T13:31:22.739641615Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}