Medium severity · published Mar 7, 2022
CVE-2021-4198
A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN…
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects: Bitdefender Total Security versions prior to 26.0.3.29. Bitdefender Internet Security versions prior to 26.0.3.29. Bitdefender Antivirus Plus versions prior to 26.0.3.29. Bitdefender Endpoint Security Tools versions prior to 7.2.2.92. Bitdefender VPN Standalone versions prior to 25.5.0.48.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Antivirus Plus · Bitdefender
before 26.0.3.29 · source: NVD
ES
Endpoint Security Tools · Bitdefender
before 7.2.2.92 · source: NVD
IS
Internet Security · Bitdefender
before 26.0.3.29 · source: NVD
TS
Total Security · Bitdefender
before 26.0.3.29 · source: NVD
VS
Vpn Standalone · Bitdefender
before 25.5.0.48 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4198
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4198
Vendor Advisory
https://www.bitdefender.com/support/security-advisories/messaging_ipc-dll-null-pointer-dereference-in-multiple-bitdefender-products-va-10016/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-483/
More from Antivirus Plus
7.8
CVE-2025-7073
Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security
7.8
CVE-2023-6154
A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows…
7.8
CVE-2022-0357
Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus…
7.8
CVE-2021-4199
Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security,…
7.8
CVE-2020-8107
A Process Control vulnerability in ProductAgentUI.exe as used in Bitdefender Antivirus Plus allows an attacker to tamper with product settings via a specially crafted DLL file