CVE-2021-40716

Published: Sep 29, 2021Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD (Secondary)

Description

XMP Toolkit SDK versions 2021.07 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected (2)

Products: Adobe: Xmp Toolkit Software Development Kit · Debian: Debian Linux

1 product

Xmp Toolkit Software Development Kit

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Adobe Xmp Toolkit Software Development Kit	Up to 2021.07

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (5)

https://helpx.adobe.com/security/products/xmpcore/apsb21-85.html

Source: psirt@adobe.com

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2023/09/msg00032.html

Source: psirt@adobe.com

Mailing ListThird Party Advisory

https://helpx.adobe.com/security/products/xmpcore/apsb21-85.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2023/09/msg00032.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2025/08/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.