LiveActive security incident?Get immediate response
CVE Record

CVE-2021-21814: Within the function HandleFileArg the argument filepattern is under control of the user who passes it in fr...

Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. filepattern is passed directly to strlen to determine the ending location of the char* passed in by the user, no checks are done to see if the passed in char* is longer than the staticly sized buffer data is memcpy‘d into, but after the memcpy a null byte is written to what is assumed to be the end of the buffer to terminate the char*, but without length checks, this null write occurs at an arbitrary offset from the buffer. An attacker can provide malicious input to trigger this vulnerability.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2021-21814 is a memory-safety flaw in AT&T Labs Xmill 0.7. A local attacker with access to run the tool could provide malicious command-line input and trigger unsafe memory handling, with high confidentiality, integrity, and availability impact under the CVSS assessment.

Executive priority

Treat as high priority only if Xmill 0.7 exists in your environment. For most organizations, the practical urgency is inventory-driven because this appears to affect a legacy local utility rather than a broadly exposed network service.

Technical view

In HandleFileArg, user-controlled filepattern is measured with strlen and copied into a statically sized buffer without length checks. A terminating null byte is then written at an offset derived from unchecked input length, creating memory corruption risk through an out-of-bounds null write.

Likely exposure

Exposure is most likely where legacy AT&T Labs Xmill 0.7 is installed and callable by local users or automation that processes untrusted file patterns. Internet-facing exposure is not indicated by the supplied CVSS vector or sources.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation. CVSS marks the attack vector as local, low complexity, low privileges required, and no user interaction required once the attacker can run the vulnerable tool.

Researcher notes

The supplied evidence supports a local memory-corruption issue caused by unchecked command-line input length. The bundle does not provide a named patch, fixed version, CWE, or active exploitation evidence, so remediation should be tied to vendor or advisory confirmation.

Mitigation direction

  • Inventory systems and build images for AT&T Labs Xmill 0.7.
  • Remove Xmill 0.7 where it is no longer operationally required.
  • Check Talos, CVE, and vendor guidance for any supported fix.
  • Restrict local access to systems where Xmill remains installed.
  • Avoid passing untrusted file patterns into Xmill workflows.

Validation and detection

  • Confirm whether AT&T Labs Xmill 0.7 is present in managed assets.
  • Review scheduled jobs and scripts that invoke Xmill.
  • Identify any workflow accepting externally supplied file patterns.
  • Verify local users cannot run Xmill unnecessarily.
  • Track KEV and vendor-advisory status for changes.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-21814 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.0HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

7.8High
CVSS 3.0 vector shape for CVE-2021-21814Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aAT&TAT&T Labs Xmill 0.7Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.