LiveActive security incident?Get immediate response
CVE Record

CVE-2021-36976: libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and pro...

libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-36976 is a memory safety bug in libarchive versions 3.4.1 through 3.5.1. Systems that unpack archives with affected libarchive builds may be exposed when handling crafted archive data. The source bundle does not provide a CVSS score or confirmed business impact.

Executive priority

Prioritize based on whether affected systems handle untrusted archives. Without CVSS or exploitation evidence, this is not automatically emergency-level, but archive-processing systems are common and should be patched through normal vulnerability management.

Technical view

The issue is described as a use-after-free in copy_string, reached from do_uncompress_block and process_block. Public references include OSS-Fuzz/Chromium bug records and downstream Fedora, Gentoo, and Apple advisories. The bundle does not provide exploit mechanics, CVSS metrics, or a complete affected-platform matrix.

Likely exposure

Exposure is most likely where libarchive 3.4.1 through 3.5.1 processes untrusted archives. This may include servers, endpoint tools, package workflows, or applications that embed libarchive. Downstream exposure should be checked against vendor advisories.

Exploitation context

CISA KEV status is false, and the provided sources do not claim active exploitation. The references point to fuzzing and vendor advisory activity, so treat this as a real memory-safety defect without evidence of exploitation in the bundle.

Researcher notes

The evidence is sparse: the CVE description names the function path and affected version range, while downstream advisories show vendor response. The bundle does not establish exploitability beyond use-after-free memory corruption or provide patch commit details.

Mitigation direction

  • Inventory libarchive versions across servers, endpoints, containers, and build images.
  • Apply vendor updates from OS or application maintainers that include this CVE.
  • Prioritize systems that parse archives from users, email, web uploads, or automated feeds.
  • Check Apple, Fedora, Gentoo, and Debian guidance for affected downstream builds.
  • Avoid processing untrusted archives on unpatched systems where practical.

Validation and detection

  • Confirm whether libarchive versions fall within 3.4.1 through 3.5.1.
  • Review package manager advisories for CVE-2021-36976 on each platform.
  • Identify applications that statically bundle or indirectly use libarchive.
  • Verify vendor update installation through package inventory or endpoint management.
  • Monitor crash reports around archive processing until remediation is complete.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-36976 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.