CVE-2021-32559 json
Integer overflow in pywin32
published 2021-07-06 5 y ago modified 2026-06-17 4 mo ago also GHSA-hwfp-hg2m-9vr2 , PYSEC-2021-112 , EUVD-2021-0214
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that would cause the size to be greater than 65535 bytes. An attacker who successfully exploited this vulnerability could crash the vulnerable process.
Patch / fix
- pypi pywin32 301
- mhammond pywin32 301
- github.com/mhammond/pywin32#1701 pull request
- github.com/mhammond/pywin32/issues/1700 advisory
Exploit prediction
1.73% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pywin32 | <301 |
301 |
Classification
- Weakness
-
- CWE-190 Integer Overflow or Wraparound
References
-
github.com
/mhammond/pywin32/pull/1701
web, third-party-advisory
-
github.com
/mhammond/pywin32/issues/1700
web, patch, third-party-advisory
-
github.com
/mhammond/pywin32/releases
web, release-notes, third-party-advisory
-
github.com
/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0017/FEYE-2021-0017.md
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-32559
advisory
-
github.com
/advisories/GHSA-hwfp-hg2m-9vr2
advisory
-
github.com
/mhammond/pywin32
package
-
github.com
/pypa/advisory-database/tree/main/vulns/pywin32/PYSEC-2021-112.yaml
web
Sources
- CVE List CVE-2021-32559
- GitHub Advisory GHSA-hwfp-hg2m-9vr2
- NVD CVE-2021-32559
- OSV PYSEC-2021-112
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.