VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 5, 2021· Updated Aug 4, 2024

CVE-2020-27841

CVE-2020-27841

Description

OpenJPEG versions prior to 2.4.0 contain an out-of-bounds read flaw in src/lib/openjp2/pi.c, which can be triggered by crafted input, leading to application denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

OpenJPEG versions prior to 2.4.0 contain an out-of-bounds read flaw in src/lib/openjp2/pi.c, which can be triggered by crafted input, leading to application denial of service.

Vulnerability

A flaw exists in openjpeg versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker provides crafted input to be processed by the openjpeg encoder, this can cause an out-of-bounds read. The affected versions are all releases before 2.4.0 [1].

Exploitation

An attacker needs the ability to supply a crafted input file to the openjpeg encoder. No special privileges are required beyond the ability to deliver the malicious image. The exact sequence of steps is not detailed, but the flaw is reachable through the encoder's normal processing of the input [1].

Impact

The out-of-bounds read can cause the application to crash, leading to denial of service. The greatest impact from this flaw is to application availability [1]. The disclosure notes that arbitrary code execution is not indicated; the primary result is a crash [3].

Mitigation

Upgrade to openjpeg version 2.4.0 or later, which contains the fix [3]. For Red Hat Enterprise Linux 8, the shipped openjpeg2 is not affected because the vulnerable code was introduced after that release [1]. A general workaround is to avoid using openjpeg to process untrusted input if an upgrade cannot be applied [1].

References
  1. heap-based buffer overflows in lib/openjp2/pi.c
  2. Multiple vulnerabilities (GLSA 202101-29) — Gentoo security

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

26

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

7

News mentions

0

No linked articles in our index yet.