CVE-2021-33910

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.

CVSS 3.1

5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

8.8% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-25)

CWE

CWE-770

Published

2021-07-20

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• fedoraproject:fedora
• netapp:hci_management_node
• netapp:solidfire
• systemd_project:systemd

References

• http://packetstormsecurity.com/files/163621/Sequoia-A-Deep-Root-In-Linuxs-Filesystem-Layer.html
• http://www.openwall.com/lists/oss-security/2021/08/04/2
• http://www.openwall.com/lists/oss-security/2021/08/17/3
• http://www.openwall.com/lists/oss-security/2021/09/07/3
• https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf

Check your stackJSON