Log in Start free

Vulnerability · Published Mar 4, 2022 · Assigned by redhat

CVE-2021-3575

High 7.8

In plain English

A high-severity out-of-bounds write in OpenJPEG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)1.5%top 24.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8openjpeg22.4.0-4.el8ALSA-2021:4251
AlmaLinux:8openjpeg2-devel2.4.0-4.el8ALSA-2021:4251
AlmaLinux:8openjpeg2-devel-docs2.4.0-4.el8ALSA-2021:4251
AlmaLinux:8openjpeg2-tools2.4.0-4.el8ALSA-2021:4251
Alpine:v3.20openjpeg2.5.0-r0ALPINE-CVE-2021-3575
Alpine:v3.21openjpeg2.5.0-r0ALPINE-CVE-2021-3575
Alpine:v3.22openjpeg2.5.0-r0ALPINE-CVE-2021-3575
Alpine:v3.23openjpeg2.5.0-r0ALPINE-CVE-2021-3575
Alpine:v3.24openjpeg2.5.0-r0ALPINE-CVE-2021-3575
Debian:12openjpeg22.5.0-2+deb12u1DEBIAN-CVE-2021-3575
Debian:12openjpeg22.5.0-2+deb12u1DSA-5851-1
Debian:13openjpeg22.5.3-1DEBIAN-CVE-2021-3575
Debian:14openjpeg22.5.3-1DEBIAN-CVE-2021-3575
Rocky Linux:8openjpeg20:2.4.0-4.el8RLSA-2021:4251
Ubuntu:22.04:LTSblenderno fix listedUBUNTU-CVE-2021-3575
Ubuntu:24.04:LTSblenderno fix listedUBUNTU-CVE-2021-3575
Ubuntu:25.10blenderno fix listedUBUNTU-CVE-2021-3575
Ubuntu:26.04:LTSblenderno fix listedUBUNTU-CVE-2021-3575
Ubuntu:26.10blenderno fix listedUBUNTU-CVE-2021-3575
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2021-3575
Ubuntu:22.04:LTSopenjpeg22.4.0-6ubuntu0.2UBUNTU-CVE-2021-3575
Ubuntu:22.04:LTSopenjpeg22.4.0-6ubuntu0.2USN-7083-1
Ubuntu:24.04:LTSopenjpeg22.5.0-2ubuntu0.2USN-7083-1
Ubuntu:24.04:LTSopenjpeg22.5.0-2ubuntu0.2UBUNTU-CVE-2021-3575
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2021-3575
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2021-3575
Ubuntu:25.10texmakerno fix listedUBUNTU-CVE-2021-3575
Ubuntu:26.04:LTStexmakerno fix listedUBUNTU-CVE-2021-3575
Ubuntu:26.10texmakerno fix listedUBUNTU-CVE-2021-3575

Affected products (as reported)

VendorProductVersions
n/a OpenJPEG Afeects v2.4.0 and prior.

Weakness: CWE-787

References