CVE-2021-20299
HIGHOpenEXR - Denial of Service via Multipart Input File NULL Pointer Dereference
Title source: llmDescription
A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.
References (4)
Core 4
Core References
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
Mailing List, Patch, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25740
Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1939154
Patch, Third Party Advisory
https://github.com/AcademySoftwareFoundation/openexr/commit/25e9515b06a6bc293d871622b8cafaee7af84e0f
Scores
CVSS v3
7.5
EPSS
0.0183
EPSS Percentile
76.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-476
Status
published
Products (2)
debian/debian_linux
10.0
openexr/openexr
< 2.5.4
Published
Mar 16, 2022
Tracked Since
Feb 18, 2026