CVE-2021-40264: 
Homebrew vulnerability analysis and mitigation

CVE-2021-40264 is a NULL pointer dereference vulnerability affecting FreeImage versions before 1.18.0. The vulnerability specifically exists in the FreeImage_CloneTag function within FreeImageTag.cpp. This security issue was discovered and reported on August 26, 2021 (NVD).

The vulnerability occurs when processing TIFF format files where the 'StripOffsets' field is handled incorrectly. When a TIFF file with OJPEG compression is processed and the 'StripOffsets' field is not present, the FreeImage_CloneTag function attempts to perform a memcpy operation on a NULL pointer. This occurs due to a specific handling path in the TIFFReadDirectory function that sets the StripOffsets field to NULL under certain conditions (SourceForge Bug). The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can lead to a Denial of Service condition through application crashes caused by the NULL pointer dereference. The impact is primarily on the availability of systems running the affected FreeImage versions (SourceForge Bug).

The primary mitigation is to upgrade FreeImage to version 1.18.0 or later, which contains the fix for this vulnerability (NVD).