CVE-2021-26706

An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes, the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker.

• CWE-190

• https://docs.silabs.com/micrium/latest/micrium-common/Vendor Advisory
• https://micrium.atlassian.net/wiki/spaces/libdoc138/Third Party Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04Third Party Advisory, US Government Resource
• https://docs.silabs.com/micrium/latest/micrium-common/Vendor Advisory
• https://micrium.atlassian.net/wiki/spaces/libdoc138/Third Party Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-119-04Third Party Advisory, US Government Resource

Published

Jan 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26700Visual Studio Code npm-script Extension Remote Code Executio…7.8
• CVE-2021-26701.NET Core Remote Code Execution Vulnerability8.1
• CVE-2021-26702EPrints 3.4.2 exposes a reflected XSS opportunity in the dat…6.1
• CVE-2021-26703EPrints 3.4.2 allows remote attackers to read arbitrary file…9.8
• CVE-2021-26704EPrints 3.4.2 allows remote attackers to execute arbitrary c…8.8
• CVE-2021-26705An issue was discovered in SquareBox CatDV Server through 9.…9.1
• CVE-2021-26707The merge-deep library before 3.0.3 for Node.js can be trick…9.8
• CVE-2021-26708A local privilege escalation was discovered in the Linux ker…7
• CVE-2021-26709D-Link DSL-320B-D1 devices through EU_1.25 are prone to mult…9.8
• CVE-2021-26710A cross-site scripting (XSS) issue in the login panel in Red…6.1
• CVE-2021-26711A frame-injection issue in the online help in Redwood Report…5.3
• CVE-2021-26712Incorrect access controls in res_srtp.c in Sangoma Asterisk …7.5