CVE-2021-20296

2021-04-0100:00:00

CWE-476

redhat

www.cve.org

openexr

null pointer

vulnerability

system availability

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

48.6%

JSON

A flaw was found in OpenEXR in versions before 3.0.0-beta. A crafted input file supplied by an attacker, that is processed by the Dwa decompression functionality of OpenEXR’s IlmImf library, could cause a NULL pointer dereference. The highest threat from this vulnerability is to system availability.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "OpenEXR",
    "versions": [
      {
        "version": "OpenEXR 3.0.0-beta",
        "status": "affected"
      }
    ]
  }
]