CVE-2021-3922 HIGH

CVE-2021-3922

Vendor Lenovo

Product IMController

Weakness CWE-367

Published May 18, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

7.8/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 that could allow a local attacker to connect and interact with the IMController child process' named pipe.

Key dates

02Disclosure timeline

May 18, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-3922 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/367.html

Related vulnerabilities

04Related CVE

CVE-2026-55950 DTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessions CVE-2026-42344 FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints CVE-2026-13742 Lack of signature verification before execution of downloaded content CVE-2026-58299 Microsoft Edge for Android Remote Code Execution Vulnerability CVE-2026-7837 TOCTOU with root privilege in ad_flush