CVE-2016-8332: Buffer Overflow
A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8332?
CVE-2016-8332 has a critical severity rating due to its potential for arbitrary code execution.
How do I fix CVE-2016-8332?
To mitigate CVE-2016-8332, update OpenJPEG to version 2.3.0-2+deb10u2 or later.
What software is affected by CVE-2016-8332?
CVE-2016-8332 affects OpenJPEG version 2.1.1 and earlier, as well as certain Android versions.
What kind of attack can exploit CVE-2016-8332?
CVE-2016-8332 can be exploited through crafted jpeg2000 image files that lead to a buffer overflow.
Who is the vendor for the affected OpenJPEG software in CVE-2016-8332?
The OpenJPEG software affected by CVE-2016-8332 is maintained by UCLouvain.