CVE-2021-38297

CRITICAL

Go <1.16.9, <1.17.2 - Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2021-38297. PoCs published by gkrishnan724, paras98.

AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2021-38297, demonstrating memory corruption in a WebAssembly (WASM) environment. The exploit leverages Go-based WASM modules to manipulate memory and extract sensitive data, showcasing the vulnerability's impact.

Description

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

Exploits (2)

nomisec WORKING POC 6 stars
by gkrishnan724 · poc
https://github.com/gkrishnan724/CVE-2021-38297

This repository contains a functional proof-of-concept exploit for CVE-2021-38297, demonstrating memory corruption in a WebAssembly (WASM) environment. The exploit leverages Go-based WASM modules to manipulate memory and extract sensitive data, showcasing the vulnerability's impact.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WebAssembly (WASM) environments with vulnerable Go implementations
No auth needed
Prerequisites: WebAssembly support in the target environment · Execution of malicious WASM module
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by paras98 · poc
https://github.com/paras98/CVE-2021-38297-Go-wasm-Replication

This repository contains a functional proof-of-concept exploit for CVE-2021-38297, demonstrating memory corruption in Go WebAssembly (WASM) applications. The exploit leverages unsafe pointer manipulation to read arbitrary memory locations, potentially leading to information disclosure or further exploitation.

Classification
Working Poc 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Go WebAssembly applications
No auth needed
Prerequisites: A vulnerable Go WASM application · Ability to execute JavaScript in the target environment
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Scores

CVSS v3 9.8
EPSS 0.1030
EPSS Percentile 95.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-120
Status published
Products (3)
fedoraproject/fedora 34
fedoraproject/fedora 35
golang/go < 1.16.9
Published Oct 18, 2021
Tracked Since Feb 18, 2026