LiveActive security incident?Get immediate response
CVE Record

CVE-2021-36045: XMP Toolkit SDK Out-of-bounds Read Vulnerability In PostScriptSupport::ConvertToDate Could Lead To Information Exposure

XMP Toolkit SDK versions 2020.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

LowCVSS 3.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2021-36045 is a low-severity memory read flaw in Adobe XMP Toolkit SDK. A malicious file opened by a user could expose small amounts of memory and potentially weaken protections such as ASLR. The sources do not show active exploitation.

Executive priority

Handle through normal vulnerability management, not emergency response. Prioritize systems that routinely open external files or process user-supplied media metadata. Escalate only if a business-critical product embeds the vulnerable SDK and cannot be updated.

Technical view

The vulnerability is a CWE-125 out-of-bounds read in PostScriptSupport::ConvertToDate affecting XMP Toolkit SDK 2020.1 and earlier. CVSS 3.1 is 3.3: local attack vector, low complexity, no privileges, user interaction required, low confidentiality impact only.

Likely exposure

Exposure is most likely where applications or packages embed Adobe XMP Toolkit SDK 2020.1 or earlier, or downstream packages such as Debian exempi before applicable security updates. File-opening workflows that process XMP metadata are the relevant surface.

Exploitation context

Exploitation requires convincing a victim to open a malicious file. The source bundle says arbitrary memory disclosure may help bypass mitigations such as ASLR. CISA KEV status is false, and no cited source confirms active exploitation.

Researcher notes

Evidence supports memory disclosure only, not code execution. Key unknowns are the exact patched upstream version and which third-party products statically embed the SDK. Validate exposure through software composition analysis and package inventory rather than assuming all Adobe products are affected.

Mitigation direction

  • Apply the vendor update or guidance in Adobe APSB21-65.
  • Apply Debian LTS exempi security updates where applicable.
  • Inventory applications and packages embedding XMP Toolkit SDK.
  • Limit opening untrusted files on systems processing XMP metadata.
  • Prioritize update testing for document and media-processing workflows.

Validation and detection

  • Identify installed or bundled XMP Toolkit SDK versions.
  • Check for XMP Toolkit SDK 2020.1 or earlier.
  • Review Debian package status for exempi updates.
  • Confirm affected file-processing paths are patched or retired.
  • Document any embedded third-party copies missed by package managers.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-125: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-36045 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
3.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
3.3CVSS 3.1LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N1.81.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

3.3Low
CVSS 3.1 vector shape for CVE-2021-36045Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
AdobeXMP Toolkitunspecified, unspecifiedListed
Weakness

CWE details

CWE-125

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-125 · source CWE mapping

Out-of-bounds Read

Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs