VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 29, 2022· Updated Nov 3, 2025

CVE-2022-1122

CVE-2022-1122

Description

In openjpeg2 2.4.0, opj2_decompress crashes due to an uninitialized pointer free when handling large input directories, causing a denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In openjpeg2 2.4.0, `opj2_decompress` crashes due to an uninitialized pointer free when handling large input directories, causing a denial of service.

Vulnerability

A flaw exists in the opj2_decompress program in openjpeg2 version 2.4.0 (and reportedly reproducible on the current master and version 2.5.0) in the way it handles an input directory with a large number of files. When the application fails to allocate a buffer to store filenames, it calls free() on an uninitialized pointer (dirptr->filename), leading to a segmentation fault. [4]

Exploitation

An attacker must provide a directory containing many files as the -ImgDir argument to opj_decompress. No authentication or special network position is required; the attack is local and can be triggered by a user running the tool on a crafted directory. The vulnerability manifests when memory allocation for the filename buffer fails due to the large number of files, subsequently calling free on an uninitialized pointer. [4]

Impact

Successful exploitation results in a segmentation fault and denial of service (DoS) of the opj2_decompress process. No other C-I-A impact (code execution, privilege escalation, or data disclosure) has been described. [4]

Mitigation

As of the available references, no official patch has been released for openjpeg2 2.4.0. The issue is reportedly present in the latest master branch and version 2.5.0. Users should avoid processing untrusted directories with a very large number of files, or limit the number of files in input directories until a fix is available. [4]

References
  1. Exist a issues of freeing uninitialized pointer in src/bin/jp2/opj_decompress.c，that will cause a segfault

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

42

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.