High
Security advisory
libmobi is vulnerable to Use of Out-of-range Pointer Offset
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-3889
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:45 UTC · Revision 1
Source evidence
libmobi is vulnerable to Use of Out-of-range Pointer Offset
osv:CVE-2021-3889
Complete source record
{
"id": "3c9bd6c45d78e305fffc6a9843b97bdb44ebf671304cc79ca831e066374e039d",
"url": "https://osv.dev/vulnerability/CVE-2021-3889",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-3889",
"summary": "libmobi is vulnerable to Use of Out-of-range Pointer Offset",
"evidence": "osv:CVE-2021-3889",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-3889",
"aliases": [
"CVE-2021-3889"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/bfabiszewski/libmobi",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "40c21718a30e01ddffe4a16b6cbb2651d701d4ae"
},
{
"fixed": "bec783e6212439a335ba6e8df7ab8ed610ca9a21"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:libmobi_project:libmobi:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.8"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "bec783e6212439a335ba6e8df7ab8ed610ca9a21"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v0.7",
"v0.6",
"v0.5",
"v0.4",
"v0.3",
"v0.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3889.json",
"vanir_signatures": [
{
"id": "CVE-2021-3889-8e24c8e7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"60941633953866768929173956639993985641",
"183843454184476539211598106013255501549",
"143765066257043244895911758730691455220",
"147513665195283254971157146680447318182",
"140351231808443371633715668491813990186",
"296309073408020226762114275721447844600",
"127278800796710865628981060257648791801",
"101974956512608900157789862989947945076"
]
},
"source": "https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21",
"target": {
"file": "src/compression.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-3889-bbe46003",
"digest": {
"length": 1545,
"function_hash": "4624666305156171928350655180407704292"
},
"source": "https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21",
"target": {
"file": "src/compression.c",
"function": "mobi_decompress_huffman_internal"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3889-d75cbc27",
"digest": {
"length": 1347,
"function_hash": "15982606896711580559032318799110888001"
},
"source": "https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21",
"target": {
"file": "src/read.c",
"function": "mobi_parse_huff"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3889-f6596980",
"digest": {
"threshold": 0.9,
"line_hashes": [
"320248425003798492802026060138869397908",
"53738011554090313359502918295970605591",
"80067300861157203983853007628640119367",
"229029659698259163062567162243171267234"
]
},
"source": "https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21",
"target": {
"file": "src/compression.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-3889-f796c5c2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"83711654140281194512571502054329484444",
"141291084972431703333183233355891047729",
"217331745260185525010947671041549721309",
"199430023177546943535288491088830199563"
]
},
"source": "https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21",
"target": {
"file": "src/read.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:26:18Z"
}
}
],
"modified": "2026-10-20T14:26:18.564158672Z",
"provider": "osv",
"references": [
"https://github.com/bfabiszewski/libmobi/commit/bec783e6212439a335ba6e8df7ab8ed610ca9a21",
"https://huntr.dev/bounties/efb3e261-3f7d-4a45-8114-e0ace6b21516"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-3889",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388986,
"published_at": "2021-10-19T13:15:11.977+00:00"
}