CVE-2021-3345

HIGH

Libgcrypt 1.9.0 - Heap-Based Buffer Overflow in _gcry_md_block_write

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2021-3345. PoCs published by MLGRadish, SpiralBL0CK.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-3345, a vulnerability in Libgcrypt 1.9.0. The exploit leverages a buffer overflow in the gcry_md_write function to achieve arbitrary code execution by overwriting a function pointer.

Description

_gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. It is recommended to upgrade to 1.9.1 or later.

Exploits (2)

nomisec WORKING POC 9 stars
by MLGRadish · poc
https://github.com/MLGRadish/CVE-2021-3345

This repository contains a functional exploit for CVE-2021-3345, a vulnerability in Libgcrypt 1.9.0. The exploit leverages a buffer overflow in the gcry_md_write function to achieve arbitrary code execution by overwriting a function pointer.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Libgcrypt 1.9.0
No auth needed
Prerequisites: Libgcrypt 1.9.0 installed · Compilation environment with clang and necessary libraries
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 3 stars
by SpiralBL0CK · poc
https://github.com/SpiralBL0CK/CVE-2021-3345

This repository contains a functional exploit for CVE-2021-3345, a heap-based buffer overflow in Libgcrypt 1.9.0. The exploit manipulates the `gcry_md_block_ctx` structure to achieve arbitrary code execution by overwriting a function pointer, leading to a shell spawn.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Libgcrypt 1.9.0
No auth needed
Prerequisites: Libgcrypt 1.9.0 installed on the target system · Ability to execute arbitrary code on the target system
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (6)

Core 6
Core References
Mailing List, Vendor Advisory x_refsource_misc
https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000455.html
Mailing List, Patch, Vendor Advisory x_refsource_misc
https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000456.html
Vendor Advisory x_refsource_misc
https://gnupg.org
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugs.gentoo.org/show_bug.cgi?id=767814
Third Party Advisory x_refsource_misc
https://www.oracle.com//security-alerts/cpujul2021.html

Scores

CVSS v3 7.8
EPSS 0.0106
EPSS Percentile 60.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (2)
gnupg/libgcrypt 1.9.0
oracle/communications_billing_and_revenue_management 12.0.0.3.0
Published Jan 29, 2021
Tracked Since Feb 18, 2026