CVE-2021-28153

MediumCVSS 5.3

Published: 11/03/2021(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.62%

85th percentile - higher than 85% of all known CVEs

Summary

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file. This could conceivably have security relevance if the symlink is attacker-controlled. If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.

Risk Assessment

An attacker who can control a symlink could cause an empty file to be created at the target location, potentially leading to data overwrite or destruction. In some scenarios, this could enable privilege escalation or disrupt application behavior.

Recommendation

Update GNOME GLib to version 2.66.8 or later. Avoid using g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION on paths that may be attacker-controlled.

Other vulnerabilities in GNOME GLib

CVE-2021-27218High
An issue in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4: if g_byte_array_new_take() is called with a buffer of 4GB or more on a 64-bit platform, the length is truncated modulo 2**32, causing unintended length truncation.

Original NVD description (English source)

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS