CVE-2021-20296

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.0.0-beta

Description A flaw in the Dwa decompression functionality of OpenEXR's IlmImf library can cause a NULL pointer dereference when processing a crafted input file supplied by an attacker. This could lead to a system availability threat. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 3.0.0-beta, update to version 3.0.0-beta or later to resolve the issue. As a temporary workaround, consider restricting the use of the Dwa decompression functionality in the IlmImf library until a patch is available. Avoid processing untrusted input files with the affected library to minimize the risk of exploitation.