In short
- CVE-2021-41193 is a CRITICAL (CVSS 9.8) vulnerability affecting com.wire:avs, wire-audio video signaling (wire).
- Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.5% of all vulnerabilities.
- Fix: update to 7.1.12 or later.
Description
Impact
A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code.
Patches
- The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x)
Workarounds
References
For more information
If you have any questions or comments about this advisory feel free to email us at [email protected]
NVD description
wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are currently no known workarounds.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free