CVE-2021-26252: 
NixOS vulnerability analysis and mitigation

A heap buffer overflow vulnerability was discovered in HTMLDOC version 1.9.12, specifically in the pspdf_prepare_page() function within ps-pdf.cxx. This security flaw was assigned CVE-2021-26252 and affects the HTMLDOC HTML processor software (NVD, CVE).

The vulnerability is classified as a heap buffer overflow (CWE-787: Out-of-bounds Write) with a CVSS v3.1 base score of 7.8 (HIGH), and vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability requires user interaction to be exploited, as indicated by the CVSS metrics (NVD).

If successfully exploited, this vulnerability could lead to arbitrary code execution and denial of service conditions. The high CVSS score indicates significant potential impact on the confidentiality, integrity, and availability of the affected system (NVD, Ubuntu).

The vulnerability requires local access and user interaction to be exploited. While the attack complexity is low, the attacker needs to convince a user to interact with a malicious payload to trigger the vulnerability (NVD).

The vulnerability has been addressed in subsequent versions of HTMLDOC. Ubuntu has released security updates for multiple versions: Ubuntu 20.04 (htmldoc - 1.9.7-1ubuntu0.3+esm1), Ubuntu 18.04 (htmldoc - 1.9.2-1ubuntu0.2+esm1), Ubuntu 16.04 (htmldoc - 1.8.27-8ubuntu1.1+esm2), and Ubuntu 14.04 (htmldoc - 1.8.27-8ubuntu1+esm3). Users are advised to update to these patched versions (Ubuntu).