CVE-2021-21830
A heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An ...
Affects 2 products across 2 vendors.
Buffer overflow corrupting dynamically allocated heap memory, exploitable for arbitrary code execution.
Software writes data past buffer boundaries, corrupting memory and potentially enabling code execution.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A heap-based buffer overflow vulnerability in AT&T Labs’ Xmill 0.7 can be exploited via a specially crafted XMI file, leading to remote code execution. This vulnerability has a CVSS score of 9.8, indicating a critical severity level. Affected vendors include AT&T, Schneider-Electric, and Wolfram Schneider. No public proof of concept or known exploits are available, and the EPSS score suggests a low likelihood of exploitation in the wild. However, due to the potential for remote code execution, immediate attention is required to mitigate this risk in ICS/OT environments.
BSID: BS-2021-GLOBAL-075850-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-21830?
What is the CVSS score for CVE-2021-21830?
Is CVE-2021-21830 actively exploited?
How do I remediate CVE-2021-21830?
What systems are affected by CVE-2021-21830?
What NERC-CIP standard applies to CVE-2021-21830?
What IEC 62443 requirement maps to CVE-2021-21830?
| CVE ID | CVE-2021-21830 |
|---|---|
| BSID | BS-2021-GLOBAL-075850-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2021-08-13 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
A heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ Xmill 0.7. An attacker can provide a specially crafted XMI file to trigger a heap-based buffer overflow, potentially leading to remote code execution. The attack can be performed remotely without any user interaction or authentication, making it highly dangerous in networked environments.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Att | Xmill | 0.7 |
| Schneider-Electric | Ecostruxure Process Expert | < 2021 |
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict file validation and input sanitization for XMI files before processing them in the affected systems. Consider using a secure XML parser that can handle and reject malformed or suspicious files.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This vulnerability violates CIP-007-R2, which requires the implementation of security controls to protect against unauthorized access to electronic security perimeters. The potential for remote code execution through a specially crafted XMI file could allow an attacker to bypass these controls.
This vulnerability maps to SR 7.6, which requires the implementation of secure coding practices to prevent buffer overflows and other memory-related vulnerabilities. The heap-based buffer overflow in Xmill 0.7 could be mitigated by adhering to these secure coding practices.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 2297cd8371f309aeaadd5a83a3e4f5ed209d55b49ccfd974528fd628a235ebea066825c146a0addc94c309d70730548c61df6c2d69e4df6be0cac872cd624dff |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →