VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 5, 2021· Updated Aug 4, 2024

CVE-2020-27843

CVE-2020-27843

Description

OpenJPEG before 2.4.0 has an out-of-bounds read in opj_t2_encode_packet, allowing denial of service via crafted input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

OpenJPEG before 2.4.0 has an out-of-bounds read in `opj_t2_encode_packet`, allowing denial of service via crafted input.

Vulnerability

CVE-2020-27843 is an out-of-bounds read vulnerability in OpenJPEG, a JPEG 2000 library, affecting versions prior to 2.4.0. The flaw exists in the opj_t2_encode_packet function in openjp2/t2.c. An attacker can provide specially crafted input to the conversion or encoding functionality, triggering an out-of-bounds read [1].

Exploitation

An attacker requires the ability to supply a specially crafted input file to OpenJPEG's conversion or encoding tools, such as opj_compress or opj_decompress. No authentication or special network position is needed if the victim processes the attacker-controlled file. The out-of-bounds read occurs during the processing of tile-part packets in the JPEG 2000 encoding path [1].

Impact

Successful exploitation leads to an out-of-bounds read, which can cause the application to crash or disclose sensitive memory. The highest threat according to the vendor is system availability (denial of service) [1]. The vulnerability does not appear to allow arbitrary code execution directly, but reading out-of-bounds may reveal sensitive information.

Mitigation

A fix was released in OpenJPEG version 2.4.0. Users should upgrade to >=media-libs/openjpeg-2.4.0:2 to address this vulnerability [3]. The Gentoo security advisory (GLSA 202101-29) recommends this update, and no workarounds are known [3]. The Red Hat Bugzilla entry indicates the issue is closed as ERRATA.

References
  1. out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c
  2. Multiple vulnerabilities (GLSA 202101-29) — Gentoo security

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

50

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

7

News mentions

0

No linked articles in our index yet.