CVE-2016-9581: the openjpeg project openjpeg2 Heap-based Buffer Overflow

Vulnerability summary

CVE-2016-9581 is a high (CVSS 8.8) Heap-based Buffer Overflow vulnerability in the openjpeg project openjpeg2. EPSS estimates a 1.94% chance of exploitation in the next 30 days, higher than 80.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 01-08-2018
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.

• CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.
• CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.