TI-2021-12233 Aliases CVE-2021-32559 GHSA-hwfp-hg2m-9vr2

An integer overflow exists in pywin32 prior to version b301 when adding an access control…

LOW 32CWE-190Published 2021-07-06 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-190 and the CVSS impact.

Summary

An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process.

Why it matters now

EPSS 0.01729 77th percentileScored 2026-11-07

Fix Fixed pywin32 (PyPI): 301

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	pywin32 (PyPI)	before 301	301	Patch available	GHSA-hwfp-hg2m-9vr2

— Vendor— Affected all versions Fixed in — No fix listed CNA
pywin32 (PyPI) Vendor— Affected before 301 Fixed in 301 Patch available GHSA-hwfp-hg2m-9vr2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mhammond:pywin32::::::::	before 301	Vulnerable	Mhammond

cpe:2.3:a:mhammond:pywin32:*:*:*:*:*:*:*:* Versions before 301 Vulnerable ·Mhammond

Remediation

Fix · GHSA-hwfp-hg2m-9vr2 pywin32 (PyPI) Fixed in 301 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-32559
2026-10-03 Alias added: GHSA-hwfp-hg2m-9vr2

References

Patch 1

https://github.com/mhammond/pywin32/issues/1700

Advisory 5

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences