VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 28, 2020· Updated Aug 4, 2024

CVE-2020-8112

CVE-2020-8112

Description

A heap-buffer-overflow in OpenJPEG's opj_t1_clbl_decode_processor allows remote code execution via crafted JPEG2000 images.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A heap-buffer-overflow in OpenJPEG's `opj_t1_clbl_decode_processor` allows remote code execution via crafted JPEG2000 images.

Vulnerability

A heap-based buffer overflow exists in the opj_t1_clbl_decode_processor function in openjp2/t1.c of OpenJPEG versions 2.3.1 through 2020-01-28, in the qmfbid==1 code path. The overflow is triggered during the decoding of specially crafted JPEG2000 images [3].

Exploitation

An attacker can exploit this vulnerability by providing a malicious JPEG2000 image file to an application using the vulnerable OpenJPEG library. Processing the image (e.g., via opj_decompress) triggers a heap buffer overflow [3]. No authentication or special privileges are required; only the ability to deliver a crafted file and have it decoded.

Impact

Successful exploitation allows an attacker to write out-of-bounds on the heap, which may lead to arbitrary code execution or denial of service. Red Hat rated this as Important severity [2][4].

Mitigation

Red Hat released updated packages for Red Hat Enterprise Linux 7 (RHSA-2020:0550) [2], 8 (RHSA-2020:0570) [1], and 8.0 SAP Solutions (RHSA-2020:0569) [4]. The fixed version is openjpeg2-2.3.1-3.el8_1 [1] or equivalent. Users should update to the patched version; as a workaround, only process trusted JPEG2000 images.

References
  1. https://access.redhat.com/errata/RHSA-2020:0570
  2. https://access.redhat.com/errata/RHSA-2020:0550
  3. Another heap buffer overflow in libopenjp2
  4. https://access.redhat.com/errata/RHSA-2020:0569

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

60

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"Missing bounds check in the `qmfbid==1` case of `opj_t1_clbl_decode_processor` in `openjp2/t1.c` allows writing past the end of a heap-allocated buffer."

Attack vector

An attacker provides a crafted JPEG2000 image file that, when decoded by `opj_decompress` or any application using the OpenJPEG library, triggers a heap-based buffer overflow in `opj_t1_clbl_decode_processor` [ref_id=2]. The overflow is a WRITE of size 16 at a heap buffer boundary, occurring specifically in the `qmfbid==1` code path [ref_id=2]. The attacker does not need authentication; the only precondition is that the victim opens the malicious image with a vulnerable version of OpenJPEG (2.3.1 through 2020-01-28).

Affected code

The vulnerability resides in the function `opj_t1_clbl_decode_processor` in `openjp2/t1.c` at line 1765 [ref_id=2]. The crash occurs in the `qmfbid==1` case, as noted in the CVE description. The Red Hat advisories confirm the affected file is `openjp2/t1.c` [ref_id=1][ref_id=3].

What the fix does

The bundle does not include a patch diff. The Red Hat advisories [ref_id=1][ref_id=3] indicate that the fix is delivered via updated packages (openjpeg2-2.3.1-3.el7_7 for RHEL 7 and openjpeg2-2.3.0-10.el8_0 for RHEL 8), but the specific code changes are not shown. The researcher's issue report [ref_id=2] notes the overflow is similar to issue #1228 and was still present on master commit b63a433, but does not describe the fix. Without the patch, the exact remediation logic cannot be detailed.

Preconditions

  • inputVictim must open a crafted JPEG2000 file using a vulnerable version of OpenJPEG (2.3.1 through 2020-01-28).
  • authNo authentication or special privileges required; the attack is triggered by normal file decoding.

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.