CVE-2021-3941

2022-03-2500:00:00

CWE-369

redhat

www.cve.org

imfchromaticities.cpp

division vulnerability

openexr

AI Score

6.9

Confidence

High

EPSS

Percentile

14.2%

JSON

In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y; and chroma.green.y * (X + Z))) / d; but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "openexr",
    "versions": [
      {
        "version": "OpenEXR 3.1.2",
        "status": "affected"
      }
    ]
  }
]