TI-2021-03185 Aliases CVE-2021-4327 GHSA-mh6x-wxv2-qm6f

SerenityOS TypedArray.cpp initialize_typed_array_from_array_buffer integer overflow

MEDIUM 44CWE-190Published 2023-03-01 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

A vulnerability was found in SerenityOS. It has been rated as critical. Affected by this issue is the function initialize_typed_array_from_array_buffer in the library Userland/Libraries/LibJS/Runtime/TypedArray.cpp. The manipulation leads to integer overflow. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as f6c6047e49f1517778f5565681fb64750b14bf60. It is recommended to apply a patch to fix this issue. VDB-222074 is the identifier assigned to this vulnerability.

Why it matters now

EPSS 0.00934 60th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	SerenityOS	all versions	—	No fix listed	CNA

SerenityOS Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:o:serenityos:serenityos::::::::	before 2021-01-27	Vulnerable	Serenityos

cpe:2.3:o:serenityos:serenityos:*:*:*:*:*:*:*:* Versions before 2021-01-27 Vulnerable ·Serenityos

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-4327
2026-10-03 Alias added: GHSA-mh6x-wxv2-qm6f

References

Exploit 1

https://devcraft.io/2021/02/11/serenityos-writing-a-full-chain-exploit.html

Patch 1

https://github.com/SerenityOS/serenity/commit/f6c6047e49f1517778f5565681fb64750b14bf60

TI-2021-11461 SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory… CVSS 3.1CRITICAL 9.8
TI-2021-10634 SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function. CVSS 3.1CRITICAL 9.1
TI-2021-09844 SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer… CVSS 3.1HIGH 7.8
TI-2021-08849 SerenityOS Unspecified is affected by: Buffer Overflow. CVSS 3.1HIGH 7.5
TI-2021-12737 SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow… CVSS 3.1HIGH 7.5
TI-2021-12736 SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could… CVSS 3.1HIGH 7.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences