VYPR
← All advisories
Unrated severityNVD Advisory· Published May 13, 2021· Updated Aug 4, 2024

CVE-2020-27823

CVE-2020-27823

Description

A heap-buffer-overflow write in OpenJPEG's encoder via crafted x,y offset inputs can allow denial of service or information disclosure.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-buffer-overflow write in OpenJPEG's encoder via crafted x,y offset inputs can allow denial of service or information disclosure.

Vulnerability

A flaw in OpenJPEG's encoder allows an attacker to pass specially crafted x,y offset input values to the opj_tcd_dc_level_shift_encode() function, leading to a heap-buffer-overflow write. The vulnerability exists in OpenJPEG versions prior to the fix committed for this CVE. The code path is reachable when the library is used to encode untrusted image files, specifically during image conversion operations [1].

Exploitation

An attacker needs only to supply a crafted image with malicious x,y offset parameters to an application using OpenJPEG for encoding. No authentication or special network position is required; the attack can be carried out by convincing a user to convert a malicious image file with OpenJPEG or by feeding the crafted input directly to the library. The trigger occurs during the encoding process in the opj_tcd_dc_level_shift_encode() function, resulting in a heap-buffer-overflow write [1].

Impact

Successful exploitation could lead to a denial of service (crash) and potentially information disclosure or arbitrary code execution, depending on the context. The highest threat is to confidentiality, integrity, and system availability. An attacker may corrupt heap memory, possibly leading to further compromise of the application or system [1].

Mitigation

Red Hat has rated this flaw as Moderate severity. The primary mitigation is to avoid using OpenJPEG to convert untrusted image files. Patches have been committed upstream, and updates are available through affected distributions such as Fedora and EPEL. Users should update to the latest fixed version of OpenJPEG (e.g., openjpeg2) for their respective package repositories as tracked in bug reports [1].

References
  1. 1905762 – (CVE-2020-27823) CVE-2020-27823 openjpeg: heap-buffer-overflow write in opj_tcd_dc_level_shift_encode()

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

64

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

5

News mentions

0

No linked articles in our index yet.