← Vulnerability feed

Vulnerability record · CVE-2021-42917 · published 1 November 2021

CVE-2021-42917: Kodi classic buffer overflow vulnerability

Kodi · Kodi

Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.

5.5 CVSS 3.1 Medium EPSS 1.9% · top 21.2% CWE-120 · Classic buffer overflow
5.5CVSS 3.1 base score, v2 4.3
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237 PatchThird Party Advisory
https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3 PatchThird Party Advisory
https://github.com/xbmc/xbmc/issues/20305 ExploitIssue TrackingThird Party Advisory
https://github.com/xbmc/xbmc/pull/20306 PatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html
https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237 PatchThird Party Advisory
https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3 PatchThird Party Advisory
https://github.com/xbmc/xbmc/issues/20305 ExploitIssue TrackingThird Party Advisory
https://github.com/xbmc/xbmc/pull/20306 PatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html

Track CVE-2021-42917 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2017-5982Kodi Chorus2 add-on directory traversal allows arbitrary file readThe Chorus2 2.4.2 add-on for Kodi contains a directory traversal flaw in its image path handling. A crafted encoded dot-dot-slash sequence lets a rem…EPSS 78%analysed6.1CVE-2018-8831Kodi persistent XSS via playlist executes script in victim browserKodi through 17.6 contains a persistent cross-site scripting flaw in how it handles playlists, allowing arbitrary HTML or script to be stored and lat…EPSS 53%analysed5.5CVE-2023-30207Kodi divide by zero vulnerabilityA divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3…EPSS 0.33%5.5CVE-2017-8314Kodi path traversal vulnerabilityDirectory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.EPSS 2.5%4.6CVE-2023-23082Kodi out-of-bounds write vulnerabilityA heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length…EPSS 0.68%5.5CVE-2025-43520Apple OS kernel memory corruption via malicious appA memory corruption flaw (classic buffer overflow) in Apple's kernel was fixed across iOS, iPadOS, macOS, tvOS, visionOS and watchOS. A malicious app…KEVEPSS 0.43%analysed8.8CVE-2025-31277Apple WebKit memory corruption via malicious web contentApple WebKit fails to handle memory correctly when processing crafted web content, leading to memory corruption across Safari, iOS, iPadOS, macOS, tv…KEVEPSS 1.6%analysed9.8CVE-2022-37055D-Link Go-RT-AC750 router buffer overflow in cgibin hnap_mainD-Link Go-RT-AC750 firmware revisions A v101b03 and B v200b02 contain a classic buffer overflow reachable through the cgibin hnap_main handler. The f…KEVEPSS 56%analysed

Source: NIST National Vulnerability Database (record CVE-2021-42917), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.