A pre-authentication heap buffer overflow exists in iperf3 versions 3.20 through 3.21, occurring in the decrypt_rsa_message() routine where a 256‑byte RSA buffer is overwritten by an attacker-controlled ciphertext size. This overflow can corrupt the heap, potentially allowing an attacker to execute arbitrary code or crash the service. The flaw is a classic buffer overflow classified under CWE‑122.

The vulnerability affects esnet’s iperf3 product in versions 3.20 and 3.21. Users running these releases are exposed. The issue was fixed in release 3.22 and later.

The vulnerability carries a CVSS score of 9.2, indicating critical severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote, over the network, where an unauthenticated client sends an oversized authentication token to trigger the heap overflow. Because the flaw is pre-authentication, an attacker does not need valid credentials to attempt exploitation.