VYPR
← All advisories
Unrated severityNVD Advisory· Published Apr 14, 2021· Updated Nov 3, 2025

CVE-2021-29338

CVE-2021-29338

Description

Integer overflow in OpenJPEG v2.4.0's opj_compress tool when processing a directory with 1048576 files leads to denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflow in OpenJPEG v2.4.0's opj_compress tool when processing a directory with 1048576 files leads to denial of service.

Vulnerability

An integer overflow vulnerability exists in OpenJPEG v2.4.0, specifically in the opj_compress command-line tool. When the -ImgDir option is used to specify a directory containing exactly 1,048,576 files, the internal variable num_images overflows during multiplication with OPJ_PATH_LEN, resulting in a truncated value (zero). This triggers an invalid memory access when the tool attempts to copy file paths into a buffer, leading to a crash. The issue was reported in the official GitHub repository [1].

Exploitation

An attacker can exploit this vulnerability by providing a crafted directory containing 1,048,576 files to the opj_compress binary via the -ImgDir command-line argument. No special privileges are required; the attacker only needs the ability to place files in a directory and execute the vulnerable binary. The crash occurs during the load_images function, as confirmed by the AddressSanitizer trace [1].

Impact

Successful exploitation results in a denial of service (DoS) due to a segmentation fault (SEGV) caused by the integer overflow. The application crashes, preventing legitimate use. No code execution or privilege escalation has been reported for this specific vulnerability [1][4].

Mitigation

A fix was released in OpenJPEG version 2.5.0. Users should upgrade to at least this version, which includes the resolution for this and other vulnerabilities [4]. No known workaround is available for older versions.

References
  1. Integer Overflow in num_images
  2. Multiple Vulnerabilities (GLSA 202209-04) — Gentoo security

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

63

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.