CVE-2021-26567: FAAD2 Project FAAD2

High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via filename and pathname options.

Affected products

• FAAD2 Project FAAD2: before 2.2.7.1 (fixed in 2.2.7.1)
• Synology Diskstation Manager: before 6.2.3-25426-3 (fixed in 6.2.3-25426-3)
• Synology Diskstation Manager Unified Controller: version 3.0 only
• Synology Skynas Firmware: affected versions not specified
• Synology VS960HD Firmware: affected versions not specified

Published 2021-02-26. Last modified 2026-06-17.