Vulnerability · Published Oct 13, 2021 · Assigned by adobe
CVE-2021-40732XMP Toolkit SDK Null Pointer Dereference
Medium 6.1
In plain English
A medium-severity null pointer dereference in XMP Toolkit from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
XMP Toolkit version 2020.1 (and earlier) is affected by a null pointer dereference vulnerability that could result in leaking data from certain memory locations and causing a local denial of service in the context of the current user. User interaction is required to exploit this vulnerability in that the victim will need to open a specially crafted MXF file.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | exempi | 2.6.0-1 | DEBIAN-CVE-2021-40732 |
| Debian:13 | exempi | 2.6.0-1 | DEBIAN-CVE-2021-40732 |
| Debian:14 | exempi | 2.6.0-1 | DEBIAN-CVE-2021-40732 |
| Ubuntu:22.04:LTS | exempi | 2.5.2-1ubuntu0.22.04.1 | USN-5483-1 |
| Ubuntu:22.04:LTS | exempi | 2.5.2-1ubuntu0.22.04.1 | UBUNTU-CVE-2021-40732 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | XMP Toolkit | unspecified – through 2020.1unspecified – through None |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H