Security readout for executives and security teams
Plain-English summary
This vulnerability can crash an application that uses Adobe XMP Toolkit when a user opens a specially crafted file. The published impact is limited to local application denial of service in the current user's context. It is not listed in CISA KEV, and the provided sources do not show active exploitation.
Executive priority
Treat this as routine patching unless the organization processes untrusted creative or metadata files at scale. Business risk is mainly user disruption or workflow interruption, not broad system compromise based on the supplied evidence.
Technical view
CVE-2021-36054 is a CWE-122 heap-based buffer overflow in XMP Toolkit SDK 2020.1 and earlier, specifically PSD_MetaHandler::CacheFileData. CVSS 3.1 is 3.3: local attack vector, low complexity, no privileges, required user interaction, unchanged scope, and low availability impact only.
Likely exposure
Exposure is most likely in applications or downstream packages embedding Adobe XMP Toolkit SDK 2020.1 or earlier, especially workflows that open PSD or metadata-bearing files from untrusted sources. Debian references indicate downstream package handling may also matter, such as exempi updates.
Exploitation context
A victim must open a crafted file locally. The provided sources describe application denial of service, not data theft, privilege escalation, or remote compromise. KEV is false, so active exploitation is not established by the supplied evidence.
Researcher notes
The key sink named by the CVE is PSD_MetaHandler::CacheFileData. Validate dependency exposure carefully because SDK issues often appear through embedded libraries. Do not infer RCE or active exploitation from the provided sources; they characterize the impact as local application denial of service.
Mitigation direction
- Apply Adobe APSB21-65 guidance for affected XMP Toolkit SDK deployments.
- Update downstream packages referenced by your Linux distribution advisories, including Debian exempi updates where applicable.
- Inventory products that embed XMP Toolkit SDK 2020.1 or earlier.
- Limit opening untrusted PSD or metadata-rich files in vulnerable applications.
- Use sandboxed file-processing workflows where practical.
Validation and detection
- Identify applications and services using Adobe XMP Toolkit SDK.
- Check embedded or packaged versions against 2020.1 and earlier exposure.
- Review Debian LTS advisories if exempi is installed or bundled.
- Confirm file-opening workflows do not process untrusted files unsandboxed.
- Document compensating controls where vendor updates are unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-36054 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L1.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.3LowVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://helpx.adobe.com/security/products/xmpcore/apsb21-65.htmlCVE reference
- [debian-lts-announce] 20230925 [SECURITY] [DLA 3585-1] exempi security updateCVE reference · mailing-list
- https://lists.debian.org/debian-lts-announce/2025/08/msg00003.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.