High
Security advisory
Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-26567
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:42 UTC · Revision 1
Source evidence
Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.
osv:CVE-2021-26567
Complete source record
{
"id": "70070eee3558eff187558fcc171e695459ab9a2a9b5cd1ee8562363f0f602dce",
"url": "https://osv.dev/vulnerability/CVE-2021-26567",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-26567",
"summary": "Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.",
"evidence": "osv:CVE-2021-26567",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-26567",
"aliases": [
"CVE-2021-26567"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/knik0/faad2",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "720f7004d6c4aabee19aad16e7c456ed76a3ebfa"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "720f7004d6c4aabee19aad16e7c456ed76a3ebfa"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"FAAD2_2_7",
"FAAD2_2_5",
"ver_2_0",
"arelease"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-26567.json",
"vanir_signatures": [
{
"id": "CVE-2021-26567-64dae37b",
"digest": {
"length": 4736,
"function_hash": "95742462205655087578236785053942125758"
},
"source": "https://github.com/knik0/faad2/commit/720f7004d6c4aabee19aad16e7c456ed76a3ebfa",
"target": {
"file": "frontend/main.c",
"function": "main"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-26567-c5b40804",
"digest": {
"threshold": 0.9,
"line_hashes": [
"306659755408664481554497882326530877476",
"213407387545487024536194668280215840308",
"148073088228211882827322902778678516414",
"16654748510347319609504716732749980679",
"330208000278894993203207276138467824409",
"297352587452118111443895761903390731583",
"320836221036234536879684924487166759834",
"124951596289727895763253951882181560404",
"19587932756649956852888588983105705900",
"138952740350482020137357106067673585353",
"204276984114376152072326174589153731527",
"291013805752271619024730546759320044380",
"323512358555906136900152563794785142316",
"229669719966857248386029785612329923687",
"41149201910957390574582480783513483136",
"251266136391002991049717518773052748937",
"318074296695251189569800443972256847883",
"265433941319363142317182450960142062579",
"188226239427061059445051681021010020172",
"212375895169298719516805237693641231011",
"81392596556405006199225184731851944896",
"135257427212578991870565203922282716675",
"73529895415045791327769103520526719311",
"316208917844620361821882407917060414594",
"189345695525901561662559109416882030903",
"129089615508674507602734237263448596672",
"256030286320760498250207455522929183010"
]
},
"source": "https://github.com/knik0/faad2/commit/720f7004d6c4aabee19aad16e7c456ed76a3ebfa",
"target": {
"file": "frontend/main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:17:25Z"
}
}
],
"modified": "2026-10-20T14:17:25.642003076Z",
"provider": "osv",
"references": [
"https://www.synology.com/security/advisory/Synology_SA_20_26",
"https://github.com/knik0/faad2/commit/720f7004d6c4aabee19aad16e7c456ed76a3ebfa"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:faad2_project:faad2:*:*:*:*:*:*:*:*"
],
"vendor_product": "faad2_project:faad2",
"extracted_events": [
{
"range": [
{
"fixed": "2.2.7.1"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:synology:diskstation_manager:*:*:*:*:*:*:*:*"
],
"vendor_product": "synology:diskstation_manager",
"extracted_events": [
{
"range": [
{
"fixed": "6.2.3-25426-3"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:synology:diskstation_manager_unified_controller:3.0:*:*:*:*:*:*:*"
],
"vendor_product": "synology:diskstation_manager_unified_controller",
"extracted_events": [
{
"range": [
{
"introduced": "3.0"
},
{
"last_affected": "3.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "2"
},
{
"fixed": "2.2.7.1"
}
],
"source": "DESCRIPTION"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-26567",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388786,
"published_at": "2021-02-26T22:15:20.707+00:00"
}