CVE-2021-42521 VTK NULL pointer dereference vulnerability
A NULL pointer dereference in VTK's XML tree reader allows attackers to crash the application via crafted input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-42521?
CVE-2021-42521 is a high-severity vulnerability in vtk, published on 25 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.
Which versions are affected by CVE-2021-42521?
3 open source packages ship an affected version, including vtk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vtk PyPI | All versions | 9.0.1 |
vtk PyPI | All versions | 9.0.1 |
vtk PyPI | All versions | 9.0.1 |
Products include Vtk Vtk.
How do I fix CVE-2021-42521?
Upgrade vtk to 9.0.1 or later.
Is CVE-2021-42521 being exploited?
There is no known exploitation of CVE-2021-42521 in the wild and no public exploit code.
Other vulnerabilities in vtk
Sources
Also known as DEBIAN-CVE-2021-42521, GHSA-xfhg-9pjg-xg7g, PYSEC-2022-255, UBUNTU-CVE-2021-42521.