CVE-2021-41496 describes a buffer overflow in NumPy versions prior to 1.19, specifically within the array_from_pyobj function. This vulnerability, affecting the numpy library, could lead to a Denial of Service (DoS) attack if an attacker constructs an array with negative values. Rated as Medium severity (CVSS 5.5), it requires local access and low privileges, with no user interaction, to achieve high availability impact. Despite its technical description, the vendor disputes it as a vulnerability, and there is no evidence of active exploitation, publicly available exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.19.0CPE matchmatch criteria | cpe:2.3:a:numpy:numpy:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Buffer Copy without Checking Size of Input in NumPy
Feb 8, 2022Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19 which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally)
Dec 14, 2021numpy: buffer overflow in the array_from_pyobj() in fortranobject.c
May 13, 2021