Log in Start free

Vulnerability · Published Jan 28, 2020 · Assigned by mitre

CVE-2020-8112

High 8.8

In plain English

A high-severity security flaw in the openjpeg package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High
Exploit odds (30 days)3.6%top 10.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20openjpeg2.3.1-r3ALPINE-CVE-2020-8112
Alpine:v3.21openjpeg2.3.1-r3ALPINE-CVE-2020-8112
Alpine:v3.22openjpeg2.3.1-r3ALPINE-CVE-2020-8112
Alpine:v3.23openjpeg2.3.1-r3ALPINE-CVE-2020-8112
Alpine:v3.24openjpeg2.3.1-r3ALPINE-CVE-2020-8112
Debian:12openjpeg22.4.0-1DEBIAN-CVE-2020-8112
Debian:13openjpeg22.4.0-1DEBIAN-CVE-2020-8112
Debian:14openjpeg22.4.0-1DEBIAN-CVE-2020-8112
Ubuntu:22.04:LTSblenderno fix listedUBUNTU-CVE-2020-8112
Ubuntu:24.04:LTSblenderno fix listedUBUNTU-CVE-2020-8112
Ubuntu:25.10blenderno fix listedUBUNTU-CVE-2020-8112
Ubuntu:26.04:LTSblenderno fix listedUBUNTU-CVE-2020-8112
Ubuntu:26.10blenderno fix listedUBUNTU-CVE-2020-8112
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2020-8112
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2020-8112
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2020-8112
Ubuntu:25.10texmakerno fix listedUBUNTU-CVE-2020-8112
Ubuntu:26.04:LTStexmakerno fix listedUBUNTU-CVE-2020-8112
Ubuntu:26.10texmakerno fix listedUBUNTU-CVE-2020-8112

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References