CVE-2021-3504

A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. The highest threat from this vulnerability is to system availability.

• CWE-125

• https://bugzilla.redhat.com/show_bug.cgi?id=1949687Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/05/msg00011.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5BNKNVYFL36P2GBEB5O36LHFRYU575H/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQXTEACRWYAZVNEOIWIYUFGG4GOXSQ22/
• https://bugzilla.redhat.com/show_bug.cgi?id=1949687Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/05/msg00011.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5BNKNVYFL36P2GBEB5O36LHFRYU575H/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQXTEACRWYAZVNEOIWIYUFGG4GOXSQ22/

Published

May 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35033A vulnerability in specific versions of Zyxel NBG6818, NBG78…7.8
• CVE-2021-35034An insufficient session expiration vulnerability in the CGI …9.1
• CVE-2021-35035A cleartext storage of sensitive information vulnerability i…6.5
• CVE-2021-35036A cleartext storage of information vulnerability in the Zyxe…6.5
• CVE-2021-35037Jamf Pro before 10.30.1 allows for an unvalidated URL redire…6.1
• CVE-2021-35039kernel/module.c in the Linux kernel before 5.12.14 mishandle…7.8
• CVE-2021-35041The blockchain node in FISCO-BCOS V2.7.2 may have a bug when…7.5
• CVE-2021-35042Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows Que…9.8
• CVE-2021-35043OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes w…6.1
• CVE-2021-35045Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.O…6.1
• CVE-2021-35046A session fixation vulnerability was discovered in Ice Hrm 2…6.1
• CVE-2021-35047Vulnerability in the CommandPost, Collector, and Sensor comp…8.8