CVE-2021-41496

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-12-17 · updated 2026-06-17
Weakness: CWE-120

Description

Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally)

Affected products

Numpy: before 1.19.0 — fixed in 1.19.0

How to fix

Upgrade to a fixed version: Numpy 1.19.0. Check the vendor advisory for mitigations.

References

https://github.com/numpy/numpy/issues/19000
https://www.oracle.com/security-alerts/cpujul2022.html
https://github.com/numpy/numpy/issues/19000
https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2021-41496 or the next vulnerability affects your stack