A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opjpiinitialiseencode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.

A heap-based buffer overflow in the qmfbid==1 case in opjt1clbldecodeprocessor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28.

Upstream Issue:

https://github.com/uclouvain/openjpeg/issues/1231

Last updated 24 July 2024

An issue was discovered in mj2/opjmj2extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when providing a prefix with 50 or more characters on the command line.

In OpenJPEG 2.3.0, there is excessive iteration in the opjt1encodecblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

A flaw was found in OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opjj2ksetupencoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

Reference: https://github.com/uclouvain/openjpeg/issues/1057

A flaw was found in OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opjt1encodecblks function in openjp2/t1.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

References: https://github.com/uclouvain/openjpeg/issues/1053

Last updated 26 August 2025

Division-by-zero vulnerabilities in the functions pinextpcrl, pinextcprl, and pinextrpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).

In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.

OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer dereferences, division-by-zero, and other errors.

Divide by zero vulnerability was found in function opjtcdinittile in tcd.c

Upstream patch:

https://github.com/uclouvain/openjpeg/commit/8f9cc62b3f9a1da9712329ddcedb9750d585505c

CVE request:

http://seclists.org/oss-sec/2016/q2/327

A heap buffer overflow in function colorcmyktorgb in color.c.

Upstream patch:

https://github.com/uclouvain/openjpeg/commit/162f6199c0cd3ec1c6c6dc65e41b2faab92b2d91

CVE request:

http://seclists.org/oss-sec/2016/q2/327

n our-of-bounds read vulnerability in sycc422torgb function triggered by specially crafted JPEG2000 image file was found in openjpeg version 2016.03.14.

CVE request (contains reproducer):

http://seclists.org/oss-sec/2016/q1/632

OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.

Stack-based buffer overflow in OpenJPEG before 1.5.2 allows remote attackers to have unspecified impact via unknown vectors to (1) lib/openjp3d/opjjp3dcompress.c, (2) bin/jp3d/convert.c, or (3) lib/openjp3d/event.c.

Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPEG before 1.5.2 allow remote attackers to have unspecified impact and vectors, which trigger a heap-based buffer overflow.

A flaw was found in OpenJPEG. A resource exhaustion can occur in the opjt1decodecblks function in tcd.c through a crafted image file, causing a denial of service.

A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.

OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG 2.5.3 and earlier, a call to opjjp2readheader may lead to OOB heap memory write when the data stream pstream is too short and pimage is not initialized.

openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.

A flaw was found in the opj2decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.

This bug is triggered when we use opjdecompress with the -t option and its argument set to 1. The latest version v2.5.2 also has this vulnerability.

Reproducible: Always

Steps to Reproduce: see https://github.com/uclouvain/openjpeg/issues/1564

References: https://github.com/uclouvain/openjpeg/issues/1564 https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8

This bug is triggered when we use opjdecompress with the -r option and its argument set to 2. Version v2.5.2 also has this vulnerability.

Reproducible: Always

Steps to Reproduce: see https://github.com/uclouvain/openjpeg/issues/1563

References: https://github.com/uclouvain/openjpeg/issues/1563 https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8 https://bugzilla.redhat.com/showbug.cgi?id=2333954

Division-by-zero vulnerabilities in the functions opjpinextcprl, opjpinextpcrl, and opjpinextrpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.

Floating Point Exception (aka FPE or divide by zero) in opjpinextcprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.

convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving the variable s.