Priority MEDIUM 62
openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00313 · Published 2025-08-07 · Fix deferred CWE-476
Priority MEDIUM 64
OpenJPEG is an open-source JPEG 2000 codec.
CVSS 4.0MEDIUM 6.6· Local · No auth · No interaction · EPSS 0.00658 · Published 2025-08-05 · Partial fix CWE-457
Priority LOW 30
A flaw was found in OpenJPEG.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00588 · Published 2024-07-13 · Partial fix · 1772713830 CWE-400
Priority LOW 21
A flaw was found in OpenJPEG.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00555 · Published 2024-07-13 · Partial fix · 1772713830 CWE-400
Priority LOW 24
A vulnerability was found in OpenJPEG similar to CVE-2019-6988.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00242 · Published 2024-07-09 · Will not fix CWE-400
Priority LOW 27
A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01104 · Published 2022-03-29 · Partial fix CWE-665
Priority LOW 37
A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01549 · Published 2022-03-04 · Partial fix CWE-787
Priority LOW 36
A flaw was found in OpenJPEG’s encoder.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01062 · Published 2021-05-13 · Partial fix CWE-20
Priority LOW 28
A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01546 · Published 2021-05-13 · Partial fix CWE-20
Priority LOW 28
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS).
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.0156 · Published 2021-04-14 · Partial fix CWE-190
Priority LOW 38
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.02013 · Published 2021-01-25 · Partial fix CWE-122
Priority LOW 28
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.0146 · Published 2021-01-05 · Partial fix CWE-125
Priority LOW 37
A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01394 · Published 2021-01-05 · Will not fix CWE-20
Priority LOW 28
A flaw was found in OpenJPEG in versions prior to 2.4.0.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01702 · Published 2021-01-05 · Partial fix CWE-125
Priority LOW 28
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.0146 · Published 2021-01-05 · Partial fix CWE-125
Priority LOW 28
There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01454 · Published 2021-01-05 · Will not fix CWE-122
Priority LOW 33
jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.02429 · Published 2020-06-29 · Partial fix CWE-416
Priority LOW 28
The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corruption) via a crafted jpeg 2000 file.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01667 · Published 2020-02-20 · No fix listed CWE-119
Priority MEDIUM 44
opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.03624 · Published 2020-01-28 · Fixed CWE-787
Priority MEDIUM 41
OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05285 · Published 2020-01-13 · Fixed CWE-787
Priority MEDIUM 42
OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.02091 · Published 2019-09-05 · Will not fix CWE-787
Priority LOW 30
In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.02596 · Published 2019-06-26 · Partial fix CWE-834
Priority MEDIUM 42
An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.02174 · Published 2019-06-26 · Partial fix CWE-190
Priority LOW 33
Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02168 · Published 2019-06-26 · Will not fix CWE-20
Priority LOW 33
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02178 · Published 2019-06-26 · Partial fix CWE-369
Load more
THREATIST.IORead the docs