CVE-2021-3826

A vulnerability was found in Libiberty. A heap and stack buffer overflow found in the dlang_lname function in d-demangle.c leads to a denial of service.

Libiberty is a component used during compilation. This vulnerability requires a corrupted input file to have already been introduced into your application’s source code. This flaw could then induce a segmentation fault during compile time. However, it would be immediately apparent to the developer or operations team that something is wrong.

In a release pipeline which utilizes libiberty, a build failure would not prevent usage of existing stable builds, so while a flaw of this type could halt the roll out of new versions of your app, it cannot impact any apps which have already been built and deployed.

If this vulnerability were exploited, organizations which follow basic industry guidance for development and security (isolation of build environment, use of version control, and restriction of commit access) would be able to recover easily. Better prepared organizations would not even experience an outage as any problematic commits would be automatically reverted. For these reasons Red Hat Product Security has rated the impact as Low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.