There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jan 5, 2021 | |
| Debian | debian-upgrade-openjpeg2 | Feb 10, 2021 | Jan 5, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-media-libs-openjpeg | Jan 27, 2021 | Jan 5, 2021 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-openjpeg-libs | May 25, 2022 | Jan 5, 2021 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-openjpeg-libs | Jun 17, 2022 | Jan 5, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-openjpeg2 | Feb 2, 2021 | Jan 5, 2021 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-openjpeg2 | Aug 10, 2021 | Jan 5, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-image-library-openjpeg2-2-4-0-11-4-31-0-1-88-1 | Mar 17, 2021 | Jan 5, 2021 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Jan 5, 2021 | |
| Suse | — | suse-upgrade-libopenjp2-7suse-upgrade-libopenjp2-7-32bitsuse-upgrade-openjpeg2suse-upgrade-openjpeg2-devel | Aug 9, 2024 | Jan 5, 2021 |
| Ubuntu | ubuntu-pro-upgrade-libopenjp2-7ubuntu-pro-upgrade-libopenjp3d7ubuntu-pro-upgrade-libopenjpip7ubuntu-upgrade-ghostscriptubuntu-upgrade-libgs9ubuntu-upgrade-libopenjp2-7ubuntu-upgrade-libopenjp3d7ubuntu-upgrade-libopenjpip7 | Jan 8, 2021 | Jan 5, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub