CVE-2021-34813

CRITICAL

Matrix libolm < 3.2.3 - Stack-Based Buffer Overflow in olm_pk_decrypt

Title source: llm
STIX 2.1

Description

Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the homeserver) because olm_pk_decrypt has a stack-based buffer overflow. Remote code execution might be possible for some nonstandard build configurations.

References (3)

Core 3
Core References
Exploit, Patch, Vendor Advisory x_refsource_misc
https://matrix.org/blog/2021/06/14/adventures-in-fuzzing-libolm
Release Notes, Vendor Advisory x_refsource_misc
https://gitlab.matrix.org/matrix-org/olm/-/releases/3.2.3

Scores

CVSS v3 9.8
EPSS 0.0426
EPSS Percentile 89.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (1)
matrix/olm < 3.2.3
Published Jun 16, 2021
Tracked Since Feb 18, 2026