CVE-2021-33897: 
Homebrew vulnerability analysis and mitigation

A buffer overflow vulnerability exists in Synthesia before version 10.7.5567 when using a non-Latin locale. The vulnerability allows user-assisted attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes that is mishandled during deletion. Additionally, in Synthesia before version 10.9, an improper path handling vulnerability allows local attackers to cause a denial of service via a crafted MIDI file with malformed bytes (MITRE CVE, Isopach Blog).

The vulnerability has a CVSS Base Score of 7.1 with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. The issue affects non-privileged users, meaning even Guest Users can trigger the vulnerability. The bug manifests when attempting to delete a specially crafted MIDI file with malformed bytes while using a non-Latin locale (Isopach Blog).

When successfully exploited, the vulnerability results in a persistent crash of the Synthesia application, causing a denial of service condition. The application becomes unusable until restarted, though there may be potential for further exploitation which has not been confirmed (Isopach Blog).

The vulnerability has been fixed in Synthesia version 10.9. Users are advised to upgrade to this version or later to mitigate the risk (Synthesia News, Isopach Blog).