CVE-2018-20845

Vulnerability

The division-by-zero vulnerabilities exist in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c of OpenJPEG through version 2.3.0. These functions are part of the packet iterator used during decoding of JPEG 2000 images. When processing crafted image data, the code computes values like rpx = res->pdx + levelno and rpy = res->pdy + levelno without checking for large values that can cause division by zero or undefined behavior on shift operations [1].

Exploitation

An attacker can exploit these vulnerabilities by providing a specially crafted JPEG 2000 image file to an application using OpenJPEG for decoding. No authentication or special privileges are required; the attacker only needs to deliver the malicious file via any vector (e.g., email, web upload). When the decoder processes the image, the vulnerable functions perform divisions by zero, leading to a crash [1].

Impact

Successful exploitation results in a denial of service (application crash). The impact is limited to availability; there is no evidence of code execution or information disclosure from the available references. The crash occurs during decoding, potentially affecting any service or user that processes untrusted JPEG 2000 images with OpenJPEG [1].

Mitigation

The fix was introduced in commit c5bd64ea146162967c29bd2af0cbb845ba3eaaaf, which adds checks to skip problematic values when rpx or rpy are >= 31 or when shift operations would cause undefined behavior [1]. Users should update to a version of OpenJPEG that includes this commit (e.g., after 2.3.0). If patching is not possible, avoid processing untrusted JPEG 2000 images. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.