Log in Start free

Vulnerability · Published Jan 25, 2021 · Assigned by redhat

CVE-2020-27814

High 7.8

In plain English

A high-severity heap buffer overflow in openjpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)2.1%top 18.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8openjpeg22.4.0-4.el8ALSA-2021:4251
AlmaLinux:8openjpeg2-devel2.4.0-4.el8ALSA-2021:4251
AlmaLinux:8openjpeg2-devel-docs2.4.0-4.el8ALSA-2021:4251
AlmaLinux:8openjpeg2-tools2.4.0-4.el8ALSA-2021:4251
Alpine:v3.20openjpeg2.3.1-r6ALPINE-CVE-2020-27814
Alpine:v3.21openjpeg2.3.1-r6ALPINE-CVE-2020-27814
Alpine:v3.22openjpeg2.3.1-r6ALPINE-CVE-2020-27814
Alpine:v3.23openjpeg2.3.1-r6ALPINE-CVE-2020-27814
Alpine:v3.24openjpeg2.3.1-r6ALPINE-CVE-2020-27814
Debian:12openjpeg22.4.0-1DEBIAN-CVE-2020-27814
Debian:13openjpeg22.4.0-1DEBIAN-CVE-2020-27814
Debian:14openjpeg22.4.0-1DEBIAN-CVE-2020-27814
Rocky Linux:8openjpeg20:2.4.0-4.el8RLSA-2021:4251
Ubuntu:22.04:LTSopenjpeg22.3.1-1ubuntu5UBUNTU-CVE-2020-27814
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2020-27814
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2020-27814

Affected products (as reported)

VendorProductVersions
n/a openjpeg before openjpeg 2.4.0

Weakness: CWE-122

References