Multiple heap-based buffer overflows in the j2kreadsot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file.
Stack-based buffer overflow in OpenJPEG before 1.5.2 allows remote attackers to have unspecified impact via unknown vectors to (1) lib/openjp3d/opjjp3dcompress.c, (2) bin/jp3d/convert.c, or (3) lib/openjp3d/event.c.
Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPEG before 1.5.2 allow remote attackers to have unspecified impact and vectors, which trigger a heap-based buffer overflow.
OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG 2.5.3 and earlier, a call to opjjp2readheader may lead to OOB heap memory write when the data stream pstream is too short and pimage is not initialized.
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
An issue was discovered in mj2/opjmj2extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when providing a prefix with 50 or more characters on the command line.
An out-of heap-based buffer write flaw was found in the way JP2, the JPEG-2000 file format reader / writer of the OpenJPEG, an open-source JPEG 2000 codec, performed processing of palette information, present in JP2 Header Box for certain JPEG 2000 format images. A remote attacker could provide a JPEG 2000 format image file with specially-crafted value of palette index, which once processed by the JPEG 2000 decoder would leak to JPEG 2000 decoder crash, or, potentially arbitrary code execution with the privileges of the user running the decoder.
References: [1] http://technet.microsoft.com/en-us/security/msvr/msvr12-004 [2] https://secunia.com/advisories/48498/
Possible upstream patch, but it references MSVR-11-117 id instead of MSVR12-004. We need to confirm both refer to the same issue:
[3] http://code.google.com/p/openjpeg/source/detail?r=1330
A heap-based buffer overflow in the qmfbid==1 case in opjt1clbldecodeprocessor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28.
Upstream Issue:
https://github.com/uclouvain/openjpeg/issues/1231
Division-by-zero vulnerabilities in the functions pinextpcrl, pinextcprl, and pinextrpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
Last updated 24 July 2024
The tcdfreeencode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."
A flaw was found in OpenJPEG. A resource exhaustion can occur in the opjt1decodecblks function in tcd.c through a crafted image file, causing a denial of service.
openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.
Last updated 26 August 2025
Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file.
Heap-based buffer overflow vulnerability in the opjmqcbyteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.
A flaw was found in OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opjt1encodecblks function in openjp2/t1.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
References: https://github.com/uclouvain/openjpeg/issues/1053
Division-by-zero vulnerabilities in the functions opjpinextcprl, opjpinextpcrl, and opjpinextrpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
A flaw was found in OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opjj2ksetupencoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
Reference: https://github.com/uclouvain/openjpeg/issues/1057
NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444torgb function in color.c, coloresycctorgb function in color.c, and sycc422torgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer dereferences, division-by-zero, and other errors.
A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.
In OpenJPEG 2.3.0, there is excessive iteration in the opjt1encodecblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
Divide by zero vulnerability was found in function opjtcdinittile in tcd.c
Upstream patch:
https://github.com/uclouvain/openjpeg/commit/8f9cc62b3f9a1da9712329ddcedb9750d585505c
CVE request:
http://seclists.org/oss-sec/2016/q2/327
A heap buffer overflow in function colorcmyktorgb in color.c.
Upstream patch:
https://github.com/uclouvain/openjpeg/commit/162f6199c0cd3ec1c6c6dc65e41b2faab92b2d91
CVE request:
http://seclists.org/oss-sec/2016/q2/327
n our-of-bounds read vulnerability in sycc422torgb function triggered by specially crafted JPEG2000 image file was found in openjpeg version 2016.03.14.
CVE request (contains reproducer):
http://seclists.org/oss-sec/2016/q1/632
OpenJPEG 1.3 and earlier allows remote attackers to cause a denial of service (memory consumption or crash) via unspecified vectors related to NULL pointer dereferences, division-by-zero, and other errors.
OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.
A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.