CVE-2021-42521: Null Pointer Dereference
There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.
Other sources
There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-42521?
CVE-2021-42521 is a medium severity vulnerability due to a NULL pointer dereference that can lead to application crashes.
How do I fix CVE-2021-42521?
To fix CVE-2021-42521, upgrade to vtk version 9.2.5 or later.
What systems are affected by CVE-2021-42521?
CVE-2021-42521 affects vtk versions prior to 9.2.5.
What does CVE-2021-42521 exploit?
CVE-2021-42521 exploits a NULL pointer dereference in the IO/Infovis/vtkXMLTreeReader component.
Is CVE-2021-42521 a local or remote vulnerability?
CVE-2021-42521 is a local vulnerability, as it requires execution of code using the affected vtk libraries.