What is the CVSS score of CVE-2021-3497?

CVE-2021-3497 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Debian Linux are affected by CVE-2021-3497?

CVE-2021-3497 presents notable security risk, a use-after-free vulnerability rated CVSS 7.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2021-3497?

Within 7 days: Identify all affected systems and apply vendor patches promptly. If patching is delayed, consider network segmentation to limit exposure.

Debian Linux CVE-2021-3497

HIGH

Use After Free (CWE-416)

2021-04-19 secalert@redhat.com

Denial Of Service Use After Free Debian Red Hat Debian Linux Enterprise Linux Gstreamer

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

Apr 19, 2021 - 21:15 nvd

HIGH 7.8

DescriptionCVE.org

GStreamer before 1.18.4 might access already-freed memory in error code paths when demuxing certain malformed Matroska files.

AnalysisAI

A use-after-free vulnerability exists in GStreamer's Matroska demuxer that can be triggered when processing malformed video files, potentially allowing attackers to execute arbitrary code or cause application crashes. The vulnerability affects GStreamer versions before 1.18.4 and requires local access with user interaction to exploit. With an EPSS score of only 0.18% and no KEV listing, this vulnerability has low real-world exploitation probability despite its high CVSS score of 7.8.

Technical ContextAI

GStreamer is a widely-used multimedia framework that provides libraries for handling audio and video streams across Linux and other platforms. The vulnerability occurs in the Matroska (MKV) file format demuxer component, where error handling code paths can access memory that has already been freed (CWE-416: Use After Free). This class of vulnerability occurs when a program continues to use a pointer after the memory it references has been deallocated, leading to unpredictable behavior including potential code execution. The affected CPE entries indicate this impacts GStreamer on Debian Linux 9.0 and 10.0, as well as Red Hat Enterprise Linux 7.0 and 8.0.

RemediationAI

Upgrade GStreamer to version 1.18.4 or later, which contains the fix for this vulnerability. Patches are available from the vendor as noted in the Red Hat Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=1945339. For Debian users, apply the security updates referenced in DSA-4900 at https://www.debian.org/security/2021/dsa-4900. As a temporary mitigation until patching is complete, avoid processing untrusted or potentially malicious Matroska (MKV) files, and consider implementing sandboxing for media processing applications to limit the impact of potential exploitation.