CVE-2021-45385

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-11 · updated 2026-06-17
Weakness: CWE-476

Description

A Null Pointer Dereference vulnerability exits in ffjpeg d5cfd49 (2021-12-06) in bmp_load(). When the size information in metadata of the bmp is out of range, it returns without assign memory buffer to `pb->pdata` and did not exit the program. So the program crashes when it tries to access the pb->data, in jfif_encode() at jfif.c:763. This is due to the incomplete patch for CVE-2020-13438.

Affected products

Rockcarry Ffjpeg: 2021-12-06

References

https://github.com/rockcarry/ffjpeg/issues/47
https://github.com/rockcarry/ffjpeg/pull/48
https://github.com/rockcarry/ffjpeg/issues/47
https://github.com/rockcarry/ffjpeg/pull/48

Get alerted when CVE-2021-45385 or the next vulnerability affects your stack