CVE-2021-26945: Buffer Overflow
Published Apr 8, 2021
·Updated
An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR.
Other sources
Integer-overflow in bool Imf25::readDeepTile<Imf25::DeepTiledInputPart>
References:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31221 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31228
— Red Hat
Affected Software
2 affected componentsFixes available
redhat/OpenEXR<3.0.1
3.0.1
OpenEXR OpenEXR<3.0.1
Remediation
Patch Available
Event History
Jun 8, 2021
CVE Published
via MITRE·11:39 AM
Data Sourced
via MITRE·11:39 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this OpenEXR vulnerability?
The vulnerability ID for this OpenEXR vulnerability is CVE-2021-26945.
2
What is the severity of CVE-2021-26945?
The severity of CVE-2021-26945 is medium.
3
What is the impact of CVE-2021-26945?
CVE-2021-26945 can lead to a heap-buffer overflow and crash an application compiled with OpenEXR.
4
Which software versions are affected by CVE-2021-26945?
Versions of OpenEXR before 3.0.1 are affected by CVE-2021-26945.
5
Is there a fix available for CVE-2021-26945?
Yes, updating to OpenEXR version 3.0.1 or later will fix CVE-2021-26945.