CVE-2021-26260: Buffer Overflow
An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215.
Other sources
Integer-overflow in Imf25::DwaCompressor::initializeBuffers
References:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29423
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-26260?
The severity of CVE-2021-26260 is high with a severity value of 5.5.
What is the affected software of CVE-2021-26260?
The affected software of CVE-2021-26260 includes OpenEXR versions before 3.0.1, Debian Linux 9.0, Debian Linux 10.0, Debian Linux 11.0, and Fedora 33.
How does CVE-2021-26260 impact OpenEXR?
CVE-2021-26260 can lead to an integer overflow and heap-buffer overflow in the DwaCompressor of OpenEXR, potentially crashing applications compiled with OpenEXR.
What is the CVE ID for the related flaw to CVE-2021-26260?
The related flaw to CVE-2021-26260 is CVE-2021-23215.
Where can I find more information about CVE-2021-26260?
You can find more information about CVE-2021-26260 at the following references: [1] [2] [3].