VYPR
← All advisories
Unrated severityNVD Advisory· Published May 13, 2021· Updated Aug 4, 2024

CVE-2020-27824

CVE-2020-27824

Description

OpenJPEG encoder buffer overflow via crafted decomposition levels leads to denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

OpenJPEG encoder buffer overflow via crafted decomposition levels leads to denial of service.

Vulnerability

A flaw exists in the OpenJPEG library's encoder, specifically in the opj_dwt_calc_explicit_stepsizes() function. An attacker who can supply crafted input with too many decomposition levels to the encoder can trigger a global-buffer-overflow read. Affected versions include OpenJPEG v2.3.1 and prior [1].

Exploitation

An attacker needs to provide a maliciously crafted image or data stream to the OpenJPEG encoder. No authentication or special privileges are required; any user or service that feeds untrusted input to the encoder can trigger the vulnerability. The overflow occurs during the calculation of step sizes when excessive decomposition levels are specified [1].

Impact

Successful exploitation causes a buffer over-read, which can lead to an application crash (denial of service). The highest threat is to system availability. No code execution or information disclosure has been demonstrated from this flaw [1].

Mitigation

The issue has been patched in upstream commit 6daf5f3e1ec6eff03b7982889874a3de6617db8d [1]. Red Hat Enterprise Linux 8 addressed the flaw via RHSA-2021:4251 on 2021-11-09 [1]. Fedora updates were also tracked. Users should update to a fixed version of OpenJPEG (e.g., later than v2.3.1) or apply the patch [1].

References
  1. 1905723 – (CVE-2020-27824) CVE-2020-27824 openjpeg: global-buffer-overflow read in opj_dwt_calc_explicit_stepsizes()

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

50

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

6

News mentions

0

No linked articles in our index yet.