CVE-2018-5268

Vulnerability

A heap-based buffer overflow exists in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp of OpenCV 3.3.1 [4]. The vulnerability occurs when the function decodes a crafted JPEG2000 image without properly validating component data, leading to an out-of-bounds write. The issue was reported in OpenCV issue #10541 [4] and addressed in a subsequent fix [2].

Exploitation

An attacker can exploit this flaw by supplying a specially crafted JPEG2000 image file to an application that uses OpenCV's imread() or similar decoding functions. No authentication or special privileges are required; the attack can be remote if the victim opens the malicious image from an untrusted source. The overflow is triggered during the readComponent8u function when a component data type mismatch causes a write past the end of the allocated heap buffer [4].

Impact

Successful exploitation corrupts heap memory, which typically results in a denial-of-service (application crash). Under favorable conditions, the attacker may achieve arbitrary code execution with the privileges of the process. The AddressSanitizer trace in the issue report [4] confirms a 1-byte write overflow adjacent to a 6-byte allocation, confirming the heap buffer overflow nature of the flaw.

Mitigation

The fix was committed to OpenCV's master branch via pull request #10566 [2] and is included in OpenCV versions starting from 3.4. Users should upgrade to OpenCV 3.4 or later. For installations running version 3.3.1 or earlier where an upgrade is not possible, avoid processing JPEG2000 images from untrusted sources. No other workaround is available in the affected version.