CVE-2021-27247: 
Tencent WeChat vulnerability analysis and mitigation

This vulnerability (CVE-2021-27247) affects Tencent WeChat 2.9.5 desktop version and allows remote attackers to disclose sensitive information. The vulnerability exists within the WXAM decoder component and requires user interaction, such as visiting a malicious page or opening a malicious file (ZDI Advisory).

The vulnerability stems from improper validation of user-supplied data in the WXAM decoder component, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), indicating a high confidentiality impact with required user interaction (ZDI Advisory).

The vulnerability allows attackers to disclose sensitive information from affected installations. This information disclosure can potentially be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process (ZDI Advisory).

The vulnerability has been fixed in WeChat version 3.1.0. Users are advised to update to this version or later to mitigate the risk (ZDI Advisory).