PT-2021-4888 · Adobe+2 · Xmp Toolkit Sdk+2

Published 2021-08-17 · Updated 2025-08-04 · CVE-2021-36057

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions XMP Toolkit SDK versions 2020.1 and earlier

Description The issue is related to a write-what-where condition vulnerability caused during the application's memory allocation process. This may cause the memory management functions to become mismatched, resulting in local application denial of service in the context of the current user. The vulnerability can be exploited by opening a specially crafted file, potentially allowing an attacker to execute arbitrary code in the context of the current user.

Recommendations For XMP Toolkit SDK versions 2020.1 and earlier, consider applying configuration changes to restrict memory allocation and prevent potential exploitation until a patch is available. As a temporary workaround, avoid opening suspicious or specially crafted files with the affected software to minimize the risk of denial of service or arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-123

Related Identifiers

BDU:2021-05623

CVE-2021-36057

DLA-3585-1

DLA-4264-1

Affected Products

Astra Linux

Debian

Xmp Toolkit Sdk

References · 16

• https://cve.org/CVERecord?id=CVE-2021-36057 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36057 · Vendor Advisory
• https://helpx.adobe.com/security/products/xmpcore/apsb21-65.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36057 · Security Note
• https://osv.dev/vulnerability/DLA-4264-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05623 · Security Note
• https://osv.dev/vulnerability/DLA-3585-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-36057 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36057 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-36057 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36057 · Vendor Advisory
• https://t.me/cibsecurity/28170 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2025/08/msg00003.html · Note
• https://gitlab.freedesktop.org/libopenraw/exempi/-/releases · Note
• https://t.me/cvenotify/71785 · Telegram Post