Vulnerability · Published Sep 1, 2021 · Assigned by adobe
CVE-2021-36054XMP Toolkit SDK Heap-based Buffer Overflow in the PSD_MetaHandler::CacheFileData Could Lead To Application Denial Of Service
Low 3.3
In plain English
A low-severity heap buffer overflow in XMP Toolkit from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)3.7%top 10.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in local application denial of service in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | exempi | 2.6.0-1 | DEBIAN-CVE-2021-36054 |
| Debian:13 | exempi | 2.6.0-1 | DEBIAN-CVE-2021-36054 |
| Debian:14 | exempi | 2.6.0-1 | DEBIAN-CVE-2021-36054 |
| Ubuntu:22.04:LTS | exempi | 2.5.2-1ubuntu0.22.04.1 | USN-5483-1 |
| Ubuntu:22.04:LTS | exempi | 2.5.2-1ubuntu0.22.04.1 | UBUNTU-CVE-2021-36054 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | XMP Toolkit | unspecified – through 2020.1unspecified – through None |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L