CVE-2021-44538

The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Furthermore, safe buffer sizes were undocumented. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. The known affected products are Element Web And SchildiChat Web.

• CWE-119

• https://gitlab.matrix.org/matrix-org/olm/-/tagsProduct, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
• https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdkPatch, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5034Third Party Advisory
• https://gitlab.matrix.org/matrix-org/olm/-/tagsProduct, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/01/msg00001.htmlMailing List, Third Party Advisory
• https://matrix.org/blog/2021/12/13/disclosure-buffer-overflow-in-libolm-and-matrix-js-sdkPatch, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5034Third Party Advisory

Published

Dec 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-44530An injection vulnerability exists in a third-party library u…9.8
• CVE-2021-44531Accepting arbitrary Subject Alternative Name (SAN) types, un…7.4
• CVE-2021-44532Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 conver…5.3
• CVE-2021-44533Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did no…5.3
• CVE-2021-44534Insufficient user input filtering leads to arbitrary file re…6.5
• CVE-2021-44537ownCloud owncloud/client before 2.9.2 allows Resource Inject…7.8
• CVE-2021-4454In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-44540A vulnerability was found in Privoxy which was fixed in get_…7.5
• CVE-2021-44541A vulnerability was found in Privoxy which was fixed in proc…7.5
• CVE-2021-44542A memory leak vulnerability was found in Privoxy when handli…7.5
• CVE-2021-44543An XSS vulnerability was found in Privoxy which was fixed in…6.1
• CVE-2021-44544DIAEnergie Version 1.7.5 and prior is vulnerable to multiple…6.1