CVE-2021-3941: Debian Linux

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 34 only; version 35 only; version 36 only
• Openexr Openexr: version 3.1.2 only
• Red Hat Enterprise Linux: version 6.0 only; version 7.0 only; version 8.0 only

Published 2022-03-25. Last modified 2026-06-17.