CVE-2021-20299

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	OpenEXR	Affected before v2.5.4

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25740Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1939154Issue Tracking, Patch, Third Party Advisory
https://github.com/AcademySoftwareFoundation/openexr/commit/25e9515b06a6bc293d871622b8cafaee7af84e0fPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00022.htmlMailing List, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25740Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1939154Issue Tracking, Patch, Third Party Advisory
https://github.com/AcademySoftwareFoundation/openexr/commit/25e9515b06a6bc293d871622b8cafaee7af84e0fPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00022.htmlMailing List, Third Party Advisory

Timeline

Published: Mar 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-20304.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.21 an CVE-2021-203005.5A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafte CVE-2021-203025.5A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to b CVE-2021-203036.1A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by CVE-2021-203047.5A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, CVE-2021-203058.1A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result CVE-2021-203064.3A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Group CVE-2021-203079.8Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary m CVE-2021-203089.8Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is simila CVE-2021-203097.5A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-ef CVE-2021-20314.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 an CVE-2021-203107.5A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trig