{"id":"CVE-2020-21674","details":"Heap-based buffer overflow in archive_string_append_from_wcs() (archive_string.c) in libarchive-3.4.1dev allows remote attackers to cause a denial of service (out-of-bounds write in heap memory resulting into a crash) via a crafted archive file. NOTE: this only affects users who downloaded the development code from GitHub. Users of the product's official releases are unaffected.","modified":"2026-08-07T15:11:55.312232Z","published":"2020-10-15T15:15:11.280Z","references":[{"type":"ADVISORY","url":"https://github.com/libarchive/libarchive/issues/1298"},{"type":"FIX","url":"https://github.com/libarchive/libarchive/commit/4f085eea879e2be745f4d9bf57e8513ae48157f4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libarchive/libarchive","events":[{"introduced":"cce09646b566c61c2debff58a70da780b8457883"},{"last_affected":"cce09646b566c61c2debff58a70da780b8457883"},{"fixed":"4f085eea879e2be745f4d9bf57e8513ae48157f4"}],"database_specific":{"cpe":"cpe:2.3:a:libarchive:libarchive:3.4.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.4.1"},{"last_affected":"3.4.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["3.4.1","v3.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-21674.json","vanir_signatures_modified":"2026-08-07T15:11:55Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libarchive/libarchive/commit/4f085eea879e2be745f4d9bf57e8513ae48157f4","target":{"file":"libarchive/archive_string.c"},"deprecated":false,"digest":{"line_hashes":["116072633996693821785027581455796757274","263475613020376564928275470288168600925","35946731963817428492056963881029968778","296071922221007169360767292332859772771","220577582959158359478493625985624478790","24629896105847692471971921686267738172","260617937097323827464431308041105301840","265771018612808281715836621317599184067","131567820986708162080378277940629658416","24629896105847692471971921686267738172","260617937097323827464431308041105301840"],"threshold":0.9},"id":"CVE-2020-21674-261c3f39"},{"deprecated":false,"digest":{"function_hash":"291484009972018707314609976661061493870","length":1087},"id":"CVE-2020-21674-596d9501","signature_type":"Function","signature_version":"v1","source":"https://github.com/libarchive/libarchive/commit/4f085eea879e2be745f4d9bf57e8513ae48157f4","target":{"file":"libarchive/archive_string.c","function":"archive_string_append_from_wcs"}},{"deprecated":false,"digest":{"length":1202,"function_hash":"80370799617205615188298360175217438738"},"id":"CVE-2020-21674-c8b835c7","signature_type":"Function","signature_version":"v1","source":"https://github.com/libarchive/libarchive/commit/4f085eea879e2be745f4d9bf57e8513ae48157f4","target":{"file":"libarchive/archive_string.c","function":"strncat_from_utf8_libarchive2"}}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}