VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 26, 2019· Updated Aug 4, 2024

CVE-2019-12973

CVE-2019-12973

Description

OpenJPEG 2.3.1's opj_t1_encode_cblks function has excessive iteration, enabling denial of service via crafted BMP file, similar to CVE-2018-6616.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

OpenJPEG 2.3.1's opj_t1_encode_cblks function has excessive iteration, enabling denial of service via crafted BMP file, similar to CVE-2018-6616.

Vulnerability

In OpenJPEG 2.3.1, the opj_t1_encode_cblks function in openjp2/t1.c performs excessive iteration when processing crafted BMP files. This flaw arises from insufficient bounds checking, allowing an attacker to trigger infinite loops or resource exhaustion. The issue is analogous to CVE-2018-6616 and affects versions prior to the commit that added dimension validation in BMP reading.

Exploitation

An attacker needs only the ability to supply a specially crafted BMP file to an application using OpenJPEG. No authentication, network access, or user interaction is required beyond opening the file. The attack vector is local file input, and the vulnerability is triggered during BMP decoding within bmp_read_rle8_data or similar routines, where missing checks on written vs. expected dimensions cause unbounded processing.

Impact

Denial of service (DoS) is the primary impact. The excessive iteration can cause CPU exhaustion, memory starvation, or application hang. No confidentiality, integrity, or privilege escalation is implied; the attacker merely disrupts availability via resource consumption.

Mitigation

A fix was committed in [1] as 8ee335227bbcaf1614124046aa25e53d67b11ec3, which adds validation for image dimensions early in BMP reading. Users should upgrade to OpenJPEG 2.4.0 or later. Gentoo issued GLSA 202101-29 [2] advising upgrade to >=media-libs/openjpeg-2.4.0. No workaround is available for unpatched versions.

References
  1. convertbmp: detect invalid file dimensions early · uclouvain/openjpeg@8ee3352
  2. Multiple vulnerabilities (GLSA 202101-29) — Gentoo security

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

34

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The application fails to validate that the actual amount of data read from a BMP file matches the dimensions specified in the file header."

Attack vector

An attacker can provide a specially crafted BMP file with mismatched dimensions to trigger excessive iteration within the image processing logic. This leads to a denial of service condition when the application attempts to process the malformed data. The vulnerability is triggered during the parsing of RLE8 encoded BMP data [ref_id=1].

Affected code

The vulnerability is located in the `bmp_read_rle8_data` function within the BMP processing logic. The issue involves the handling of pixel data iteration relative to the image dimensions defined in the file header [ref_id=1].

What the fix does

The patch introduces a tracking variable to count the number of pixels written during the RLE8 decoding process [ref_id=1]. After the decoding loop completes, the code compares the total number of pixels written against the expected value derived from the image's width and height. If these values do not match, the function returns an error, preventing the application from proceeding with invalid or inconsistent image data [ref_id=1].

Preconditions

  • inputThe attacker must provide a crafted BMP file with inconsistent dimension metadata.

Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.