In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file.

published 2021-07-05 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-21974

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding

Patch / fix

distros 2 links 2

suse arch linux

tk SLE Module for Desktop Applications 15 SP3, SLE Module for Basesystem 15 SP3 8.6.12-150300.10.3.1
tcl SLE Module for Basesystem 15 SP3 8.6.12-150300.14.3.1
tk SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 8.6.12-11.3.1
tcl SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 8.6.12-11.3.1

suse advisories SUSE-FU-2022:0868-1 SUSE-FU-2022:0484-1

tcl Arch Linux 8.6.12-1

arch linux advisories AVG-2135

github.com/tcltk/tcl@4705dbd commit
core.tcl-lang.org/tcl/info/28ef6c0c741408a2 advisory

Exploit prediction

1.69% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

core.tcl-lang.org https://core.tcl-lang.org/tcl/info/28ef6c0c741408a2 referenced PoC, tagged "exploit" by a source, unverified
core.tcl-lang.org https://core.tcl-lang.org/tcl/info/bad6cc213dfe8280 referenced PoC, tagged "exploit" by a source, unverified
sqlite.org https://sqlite.org/forum/info/7dcd751996c93ec9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-134 Use of Externally-Controlled Format String

References

github.com /tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222
patch, third-party-advisory
core.tcl-lang.org /tcl/info/28ef6c0c741408a2
exploit, patch, vendor-advisory
core.tcl-lang.org /tcl/info/bad6cc213dfe8280
exploit, vendor-advisory
sqlite.org /forum/info/7dcd751996c93ec9
exploit, third-party-advisory

Sources

CVE List CVE-2021-35331
NVD CVE-2021-35331

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary