LiveActive security incident?Get immediate response
CVE Record

CVE-2021-45935: Grok 9.5.0 has a heap-based buffer overflow in openhtj2k::T1OpenHTJ2K::decompress (called from std::__1::__...

Grok 9.5.0 has a heap-based buffer overflow in openhtj2k::T1OpenHTJ2K::decompress (called from std::__1::__packaged_task_func<std::__1::__bind<grk::T1DecompressScheduler::deco and std::__1::packaged_task<int).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-45935 describes a heap-based buffer overflow in Grok 9.5.0 during OpenHTJ2K decompression. In business terms, software using this component to process crafted image data could crash or behave unpredictably. The public record does not provide CVSS scoring, a confirmed fix version, or active exploitation evidence.

Executive priority

Treat this as a targeted exposure-review item, not an emergency by default. Prioritize quickly if Grok 9.5.0 handles external or customer-supplied image files, because memory corruption in parsers can create meaningful service and security risk.

Technical view

The reported flaw is in openhtj2k::T1OpenHTJ2K::decompress, reached through Grok decompression scheduling code. It was tracked through OSS-Fuzz. The source bundle does not include detailed affected CPEs, exploitability assessment, patch metadata, or a CWE mapping beyond the buffer overflow description.

Likely exposure

Exposure is most likely where Grok 9.5.0 or embedded OpenHTJ2K code processes untrusted HTJ2K or JPEG 2000-style image inputs. The CVE record’s affected product section is incomplete, so teams must verify usage through dependency and binary inventory.

Exploitation context

No source in the bundle states active exploitation, and the CVE is not listed as KEV. OSS-Fuzz reporting indicates the issue was found by fuzz testing, but the bundle does not confirm exploitability, public proof-of-concept availability, or real-world attacks.

Researcher notes

The public data is sparse: severity is unknown, affected CPEs are absent, and the provided sources do not identify a patch. Analysis should focus on confirming component presence, input reachability, and whether later Grok or OpenHTJ2K changes address OSS-Fuzz issue 39021.

Mitigation direction

  • Check Grok and OpenHTJ2K upstream guidance for fixed versions or advisories.
  • Identify and update any Grok 9.5.0 deployments when vendor-supported fixes are confirmed.
  • Restrict untrusted image processing until exposure and fix status are understood.
  • Run file-processing workloads with least privilege and isolation controls.
  • Monitor the OSS-Fuzz issue and CVE record for remediation updates.

Validation and detection

  • Search software inventory for Grok 9.5.0 and OpenHTJ2K usage.
  • Review build manifests, containers, and vendor SBOMs for bundled Grok components.
  • Confirm whether services process untrusted HTJ2K or JPEG 2000 inputs.
  • Check deployed versions against upstream Grok and OpenHTJ2K guidance.
  • Document compensating controls for any exposed file-processing paths.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-45935 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.