CVE-2017-17821

WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function (in WTF/wtf/FastBitVector.cpp) for a purpose other than initializing a bitvector size, and resizeSlow mishandles cases where the old array length is greater than the new array length.

• CWE-119

• https://bugs.webkit.org/show_bug.cgi?id=181020Permissions Required
• https://github.com/dwfault/PoCs/blob/master/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF.mdThird Party Advisory
• https://bugs.webkit.org/show_bug.cgi?id=181020Permissions Required
• https://github.com/dwfault/PoCs/blob/master/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF.mdThird Party Advisory

Published

Dec 21, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-17815In Netwide Assembler (NASM) 2.14rc0, there is an illegal add…
• CVE-2017-17816In Netwide Assembler (NASM) 2.14rc0, there is a use-after-fr…
• CVE-2017-17817In Netwide Assembler (NASM) 2.14rc0, there is a use-after-fr…
• CVE-2017-17818In Netwide Assembler (NASM) 2.14rc0, there is a heap-based b…
• CVE-2017-17819In Netwide Assembler (NASM) 2.14rc0, there is an illegal add…
• CVE-2017-17820In Netwide Assembler (NASM) 2.14rc0, there is a use-after-fr…
• CVE-2017-17822The List Users API of Piwigo 2.9.2 is vulnerable to SQL Inje…
• CVE-2017-17823The Configuration component of Piwigo 2.9.2 is vulnerable to…
• CVE-2017-17824The Batch Manager component of Piwigo 2.9.2 is vulnerable to…
• CVE-2017-17825The Batch Manager component of Piwigo 2.9.2 is vulnerable to…
• CVE-2017-17826The Configuration component of Piwigo 2.9.2 is vulnerable to…
• CVE-2017-17827Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via…