CVE-2021-27218

HighCVSS 7.5

Published: 15/02/2021(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.08%

91th percentile - higher than 91% of all known CVEs

Summary

An issue in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4: if g_byte_array_new_take() is called with a buffer of 4GB or more on a 64-bit platform, the length is truncated modulo 2**32, causing unintended length truncation.

Risk Assessment

This could lead to application misbehavior such as buffer overflows or other errors that could be exploited by an attacker.

Recommendation

Upgrade GLib to 2.66.7 or 2.67.4 (depending on the series).

Other vulnerabilities in GNOME GLib

CVE-2021-28153Medium
An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file. This could conceivably have security relevance if the symlink is attacker-controlled. If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.

Original NVD description (English source)

An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS