NULL Pointer Dereference Vulnerability in VTK by Kitware

CVE-2021-42521

What is CVE-2021-42521?

A NULL pointer dereference vulnerability exists in the Visualization Toolkit (VTK) prior to version 9.2.5. This vulnerability is found in the file IO/Infovis/vtkXMLTreeReader.cxx, where the return value of the libxml2 API function 'xmlDocGetRootElement' is not properly validated. If this function returns NULL, the application will attempt to dereference a NULL pointer, potentially leading to an unexpected application crash. It is crucial for users of affected VTK versions to apply updates to mitigate this risk and ensure application stability.

References