Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

openjpeg2 may crash or run code when opening malicious PNG

published 5 years ago
Summary

The openjpeg2 library used for handling images can be tricked by specially crafted PNG files to overflow its memory. This could cause the program using the library to stop working or, in rare cases, let an attacker run code with the same rights as the user. Update openjpeg2 to version 2.3.1-12 or later to eliminate the risk.

What to do
  • Update azure openjpeg2 to version 2.3.1-12.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure openjpeg2 < 2.3.1-12
Fix: upgrade to 2.3.1-12
Original advisory text
CVE-2020-27814 affecting package openjpeg2 for versions less than 2.3.1-12
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.8 High
Timeline
Published26 Jan 2021
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-45072 · OSV
Track software like this
Free during beta