A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image.

Published 10 y ago 2016-10-28 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

2.6%

percentile 85%

Public exploits

none known

A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.

Exploit prediction (EPSS)

2.56% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.5	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`
CNA	3.0	7.5	`CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	3.0	7.8	`CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

OPENJPEG OPENJPEG

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

debian.org /security/2017/dsa-3768 · vendor-advisory, x_refsource_DEBIAN, x_transferred
securityfocus.com /bid/93242 · vdb-entry, x_refsource_BID, x_transferred
securitytracker.com /id/1038623 · vdb-entry, x_refsource_SECTRACK, x_transferred
oracle.com /security-alerts/cpujul2020.html · x_refsource_MISC, x_transferred
talosintelligence.com /reports/TALOS-2016-0193/ · x_refsource_MISC, x_transferred
github.com /uclouvain/openjpeg/releases/tag/v2.1.2 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2016-8332
NVD: CVE-2016-8332

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.