CVE-2021-24032: Facebook Zstandard

Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days.

Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.

Affected products

• Facebook Zstandard: from 1.4.1, before 1.4.9 (fixed in 1.4.9)

Published 2021-03-04. Last modified 2026-10-08.