CVE-2021-35331

In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding

References

Affected packages

Git / github.com/tcltk/tcl

Affected ranges

Type

GIT

Repo

https://github.com/tcltk/tcl

Events

Introduced

17b5b3e0201cdf92d3c125776e1b2dd453f225bd

Last affected

17b5b3e0201cdf92d3c125776e1b2dd453f225bd

Fixed

4705dbdde2f32ff90420765cd93e7ac71d81a222

Database specific

{
    "extracted_events": [
        {
            "introduced": "8.6.11"
        },
        {
            "last_affected": "8.6.11"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:tcl:tcl:8.6.11:*:*:*:*:*:*:*"
}

Affected versions

8.*

8.6.11

Other

core-8-6-11

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-35331.json"

vanir_signatures_modified

"2026-07-08T23:58:05Z"

vanir_signatures

[
    {
        "id": "CVE-2021-35331-03722e49",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "338794718477778830788026938893809680996",
                "167523017892673006030716419150005314888",
                "255738228804160061589439085284092356741",
                "128920200318728874743013425295381636087",
                "76778023355815920090853215777728435607",
                "105858589626416364655426904205864977080",
                "172666521847550365368341013690159064849",
                "307508334135556441185366936693295759738"
            ]
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "deprecated": false,
        "target": {
            "file": "win/nmakehlp.c"
        },
        "source": "https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222"
    },
    {
        "id": "CVE-2021-35331-73057c0f",
        "digest": {
            "function_hash": "79655282905794098102193868097258390460",
            "length": 1577.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "deprecated": false,
        "target": {
            "file": "win/nmakehlp.c",
            "function": "SubstituteFile"
        },
        "source": "https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222"
    }
]