{"id":"CVE-2021-3520","revision":"bf187e1bb2f34def925b38e489344923","records":[{"revision":"bf187e1bb2f34def925b38e489344923","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2021-3520","aliases":[],"title":"There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a…","description":"There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.","state":0,"publishedAt":"2021-06-02T12:32:32+00:00","modifiedAt":"2026-10-14T09:49:43.089+00:00","affected":[{"ecosystem":"Vendor product","name":"lz4","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"lz4\",\n                    \"vendor\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"lz4-1.8.3\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://bugzilla.redhat.com/show_bug.cgi?id=1954559","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.netapp.com/advisory/ntap-20211104-0005/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-3520","license":"CVE Program Terms of Use","key":"cve-program:CVE-2021-3520","identifiers":["CVE-2021-3520"]},"retained":false,"historicalAffected":[]}],"coverage":[]}