Vulnerability · Published Jan 9, 2025 · Assigned by redhat
CVE-2024-56826Openjpeg: heap buffer overflow in bin/common/color.c
Medium 5.6
In plain English
A medium-severity heap buffer overflow in openjpeg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.3%top 75.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | openjpeg2 | 2.4.0-8.el9 | ALSA-2025:7309 |
| AlmaLinux:9 | openjpeg2-devel | 2.4.0-8.el9 | ALSA-2025:7309 |
| AlmaLinux:9 | openjpeg2-tools | 2.4.0-8.el9 | ALSA-2025:7309 |
| Debian:12 | openjpeg2 | 2.5.0-2+deb12u1 | DEBIAN-CVE-2024-56826 |
| Debian:12 | openjpeg2 | 2.5.0-2+deb12u1 | DSA-5851-1 |
| Debian:13 | openjpeg2 | 2.5.3-1 | DEBIAN-CVE-2024-56826 |
| Debian:14 | openjpeg2 | 2.5.3-1 | DEBIAN-CVE-2024-56826 |
| Rocky Linux:9 | openjpeg2 | 0:2.4.0-8.el9 | RLSA-2025:7309 |
| Ubuntu:22.04:LTS | blender | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:24.04:LTS | blender | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:25.10 | blender | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:26.04:LTS | blender | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:26.10 | blender | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:22.04:LTS | ghostscript | 9.55.0~dfsg1-0ubuntu5.12 | USN-7623-1 |
| Ubuntu:24.04:LTS | ghostscript | 10.02.1~dfsg1-0ubuntu7.7 | USN-7623-1 |
| Ubuntu:22.04:LTS | insighttoolkit4 | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:22.04:LTS | openjpeg2 | 2.4.0-6ubuntu0.3 | UBUNTU-CVE-2024-56826 |
| Ubuntu:22.04:LTS | openjpeg2 | 2.4.0-6ubuntu0.3 | USN-7223-1 |
| Ubuntu:24.04:LTS | openjpeg2 | 2.5.0-2ubuntu0.3 | UBUNTU-CVE-2024-56826 |
| Ubuntu:24.04:LTS | openjpeg2 | 2.5.0-2ubuntu0.3 | USN-7223-1 |
| Ubuntu:25.10 | qtwebengine-opensource-src | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:26.10 | qtwebengine-opensource-src | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:25.10 | texmaker | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:26.04:LTS | texmaker | no fix listed | UBUNTU-CVE-2024-56826 |
| Ubuntu:26.10 | texmaker | no fix listed | UBUNTU-CVE-2024-56826 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| openjpeg | see references | |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
References
- RHSA-2025:7309 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-56826 vdb-entry, x_refsource_REDHAT
- RHBZ#2335172 issue-tracking, x_refsource_REDHAT
- https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8
- https://github.com/uclouvain/openjpeg/issues/1563
- https://lists.debian.org/debian-lts-announce/2025/04/msg00002.html