Security readout for executives and security teams
Plain-English summary
CVE-2021-36489 is a buffer overflow in Allegro's allegro_image addon through version 5.2.6. A malicious PCX, TGA, or BMP file can crash affected software, creating a denial-of-service risk. The public data does not show data theft, code execution, or confirmed active exploitation.
Executive priority
Treat this as a focused availability risk, not a broad compromise indicator. Prioritize internet-facing or customer-facing file ingestion paths first, then embedded desktop or multimedia products that process untrusted images.
Technical view
The CVE describes CWE-787 out-of-bounds write behavior in Allegro through 5.2.6 when allegro_image handles crafted PCX, TGA, or BMP files. CVSS 3.1 is 6.5 with network attack vector, low complexity, no privileges, required user interaction, and high availability impact only.
Likely exposure
Exposure is likely limited to applications that embed Allegro through 5.2.6 and use allegro_image to parse user-supplied or externally sourced PCX, TGA, or BMP files.
Exploitation context
The source bundle does not cite KEV listing or active exploitation. The CVSS vector indicates user interaction is required, so a target must process a malicious image file through the vulnerable addon.
Researcher notes
Affected CPE data is listed as n/a in the bundle, so product mapping requires dependency-level investigation. No source in the bundle names a patch version, exploit proof, or in-the-wild activity.
Mitigation direction
- Inventory applications using Allegro and allegro_image through version 5.2.6.
- Check Allegro project guidance and the referenced GitHub issue for fixed-version details.
- Avoid processing untrusted PCX, TGA, or BMP files until remediated.
- Restrict upload and import paths that reach allegro_image parsers.
- Run vulnerable image processing in isolated, restartable service boundaries.
Validation and detection
- Confirm whether Allegro is present in application dependency manifests or vendor SBOMs.
- Verify whether allegro_image is compiled, linked, or packaged with the application.
- Map all user-controlled file ingestion paths for PCX, TGA, and BMP.
- Review crash telemetry for image parsing failures in affected workflows.
- Document compensating controls where upgrade status is unknown.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-36489 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/liballeg/allegro5/issues/1251CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.