TI-2016-07794 Aliases CVE-2016-9572 GHSA-3fxp-m3gr-pfvm

NULL pointer dereference in openjpeg

LOW 33CWE-476Published 2018-08-01 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-476.

Summary

A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image.

Why it matters now

EPSS 0.02175 82nd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The OpenJPEG Project	openjpeg	2.1.2	—	No fix listed	CNA

openjpeg VendorThe OpenJPEG Project Affected 2.1.2 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:uclouvain:openjpeg:2.1.2:::::::*	2.1.2	Vulnerable	The OpenJPEG Project
cpe:2.3:o:debian:debian_linux:8.0:::::::*	8.0	Vulnerable	Debian

cpe:2.3:a:uclouvain:openjpeg:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·The OpenJPEG Project
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2018-08-01
The OpenJPEG Project openjpeg — DSA-3768
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2016-07795 Out-of-bounds read in openjpegPriority MEDIUM 40
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 2 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7

Timeline

2026-10-02 Threatist record created from CVE-2016-9572
2026-10-03 Alias added: GHSA-3fxp-m3gr-pfvm

References

Exploit 2

Patch 1

https://github.com/szukw000/openjpeg/commit/7b28bd2b723df6be09fe7791eba33147c1c47d0d

Advisory 2

Other 1

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

TI-2025-34608 OpenJPEG allows OOB heap memory write in opj_jp2_read_header CVSS 4.0MEDIUM 6.6
TI-2025-32278 openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c. CVSS 3.1MEDIUM 6.5
TI-2012-02889 Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG… CVSS 2.0HIGH 10.0
TI-2017-12771 In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume… CVSS 3.1CRITICAL 9.8
TI-2017-12770 In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage… CVSS 3.0CRITICAL 9.8
TI-2015-07301 Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG… CVSS 3.0CRITICAL 9.8

See all 81 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences