CVE-2021-31616

2021-05-0611:01:42

mitre

www.cve.org

9.2 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.2%

JSON

Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted messages. The overflow in ethereum_extractThorchainSwapData() in ethereum.c can circumvent stack protections and lead to code execution. The vulnerable interface is reachable remotely over WebUSB.