cve.bz

CVE-2021-21235

6.5 mediumEPSS 1.5%

Medium (6.5) in kamadak-exif project kamadak-exif. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in kamadak-exif 0.5.3.

kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS
1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWEs
CWE-835, CWE-400
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-px9g-8hgv-jvg2crates.iokamadak-exif>=0.5.2 <0.5.30.5.3
RUSTSEC-2021-0143crates.iokamadak-exif>=0.5.2 <0.5.30.5.3

References

Check your stackJSON