Skip to content
Fencer Vulns
high 7.8

CVE-2021-36048 json

XMP Toolkit SDK Improper Input Validation Could Lead To Arbitrary Code Execution

published 2021-09-01 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-22681

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Improper Input Validation vulnerability potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted file.

Patch / fix

  • exempi Debian 14, Debian 13, Debian 12 2.6.0-1

debian advisories DEBIAN-CVE-2021-36048

  • exempi Ubuntu 18.04 LTS 2.4.5-2ubuntu0.1
  • exempi Ubuntu 20.04 LTS 2.5.1-1ubuntu0.1
  • exempi Ubuntu 22.04 LTS 2.5.2-1ubuntu0.22.04.1

ubuntu advisories UBUNTU-CVE-2021-36048

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

2.70% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Adobe XMP Toolkit

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.