CVE-2021-45927: 
NixOS vulnerability analysis and mitigation

CVE-2021-45927 affects MDB Tools (mdbtools) version 0.9.2, where a stack-based buffer overflow vulnerability exists at memory location 0x7ffd6e029ee0 in the mdbnumerictostring function, which is called from mdbxferbounddata and mdbattempt_bind functions (NVD, OSS-Fuzz). The vulnerability was discovered and disclosed in December 2021.

The vulnerability is classified as a dynamic stack-based buffer overflow that occurs during a write operation of 16 bytes. The issue manifests in the mdbnumerictostring function when called through the execution chain of mdbxferbounddata and mdbattempt_bind. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The buffer overflow vulnerability can potentially lead to arbitrary code execution, with high impacts on confidentiality, integrity, and availability of the affected system. The CVSS scoring indicates that successful exploitation could result in a complete compromise of the affected component's security (NVD).

The vulnerability has been fixed in version 0.9.3 of MDB Tools. Users are advised to upgrade to this version or later to address the security issue. The fix was implemented through commit 373b7ff4c4daf887269c078407cb1338942c4ea6 (GitHub Commit, Gentoo Security).