CVE-2021-26706 - CVE House
Back to Database
Status published Critical CVE-2021-26706

An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB...

Vulnerability Description

An issue was discovered in lib_mem.c in Micrium uC/OS uC/LIB 1.38.x and 1.39.00. The following memory allocation functions do not check for integer overflow when allocating a pool whose size exceeds the address space: Mem_PoolCreate, Mem_DynPoolCreate, and Mem_DynPoolCreateHW. Because these functions use multiplication to calculate the pool sizes, the operation may cause an integer overflow if the arguments are large enough. The resulting memory pool will be smaller than expected and may be exploited by an attacker.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-26706

Credits & Attribution

No credits recorded in the NVD database.

References

Affected Vendor

Affected Software

uc\/lib
Vulnerable Versions:
1.38.00, 1.38.01, 1.38.02, 1.38.03, 1.38.04, 1.38.05, 1.39.00

Timeline

Official Publish: January 24th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.