VYPR
← All advisories
High severityNVD Advisory· Published Dec 17, 2021· Updated Aug 4, 2024

CVE-2021-41495

CVE-2021-41495

Description

A missing return-value validation in numpy.sort's PyArray_DescrNew function can cause a null pointer dereference, enabling denial-of-service under memory exhaustion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing return-value validation in numpy.sort's PyArray_DescrNew function can cause a null pointer dereference, enabling denial-of-service under memory exhaustion.

Vulnerability

A null pointer dereference vulnerability exists in NumPy versions before 1.19 in the PyArray_DescrNew function within numpy.sort [1][4]. The function can return NULL under memory exhaustion (e.g., at [point 1], [point 2], [point 3] in the source), yet many call sites—such as PyArray_DescrNewByteorder—fail to validate the return value before dereferencing it, leading to a crash [1][4].

Exploitation

An attacker must be able to exhaust system memory, which generally requires elevated privileges or control over resource allocation [1]. If memory exhaustion is achieved precisely when PyArray_DescrNew is called during sorting operations, the missing null check causes an immediate null pointer dereference [1][4]. The official description notes that it is "practically impossible" to construct an attack that targets this exact memory exhaustion point, and the attacker would already be privileged if they can exhaust memory [1].

Impact

Successful exploitation results in a denial-of-service (DoS) via application crash [1]. The impact is limited to availability; no data confidentiality or integrity compromise is expected [1]. The affected component is numpy.sort, and the null pointer dereference occurs within the CPython process running NumPy [1][4].

Mitigation

Users should upgrade to NumPy version 1.19 or later, where the missing return-value validation is addressed [1]. No official workaround has been published for earlier versions. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of December 2021 [1]. If an upgrade is not immediately possible, limiting memory allocation for untrusted inputs may reduce the attack surface, though practical exploitation is considered extremely unlikely [1].

References
  1. NVD - CVE-2021-41495
  2. Missing return-value validation of the function PyArray_DescrNew

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
numpyPyPI
< 1.191.19

Affected products

46

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.