CVE-2018-20847

Vulnerability

CVE-2018-20847 is an improper computation of tile boundary parameters (p_tx0, p_tx1, p_ty0, p_ty1) in the opj_get_encoding_parameters function within openjp2/pi.c of OpenJPEG through version 2.3.0. The use of signed integer arithmetic for the calculation of these tile coordinates can result in an integer overflow when processing a crafted JPEG2000 image. This overflow subsequently triggers a heap-buffer-overflow in opj_tcd_code_block_dec_allocate called from opj_tcd_init_decode_tile during tile decoding [1]. The issue was addressed by switching to unsigned integer arithmetic with saturation (e.g., opj_uint_max, opj_uint_min, opj_uint_adds) in the fix commits [2][3].

Exploitation

An attacker needs to provide a maliciously crafted JPEG2000 (.jp2 or .j2k) image to an application using the vulnerable OpenJPEG library. No special privileges or network access beyond delivering the file (e.g., via web upload, email attachment, or direct file read) are required. The decompression process will trigger the integer overflow when computing the tile boundaries, leading to an undersized allocation for tile data structures, followed by a heap buffer over-read or over-write when the decoder writes code-block data [1]. The ASAN report in the issue shows a READ of size 4 from a heap buffer, indicating a heap-buffer-overflow [1].

Impact

Successful exploitation can result in either information disclosure (heap memory read) or, depending on the memory layout, a crash or potential arbitrary code execution (write primitive). The vulnerability is triggered during the decoding of a crafted image, allowing an attacker to corrupt heap metadata or sensitive data. The CVSS v3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impact with low attack complexity.

Mitigation

The vulnerability is fixed in OpenJPEG versions after 2.3.0. Commits [2] and [3] in the official GitHub repository implement the fix by replacing signed integer tile boundary calculations with unsigned saturated arithmetic. Users must update to a patched version (2.3.1 or later) or apply the specific patches to affected codebases. No workaround is available other than migration to a fixed version, as the vulnerable code path is fundamental to JPEG2000 decoding. The CVE is not listed on the CISA KEV as of this writing.