Openjph
Monthly
Heap out-of-bounds write in OpenJPH 0.32.0 and earlier allows memory corruption when the library decodes a crafted JPEG 2000 codestream (.j2c or .jph) that uses small precinct sizes to create degenerate one-row codeblocks; the HTJ2K cleanup-pass decoder then writes a second row beyond the end of the codeblock buffer, causing heap corruption and crashes. Publicly available exploit code exists, including a detailed technical write-up, but there is no indication of confirmed active exploitation (no CISA KEV listing), and the assessed attack vector is local with user interaction (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, integrity impact low, availability impact high). Realistic exposure requires OpenJPH to sit in a decode path that accepts untrusted images, such as an upload handler, image viewer, or batch conversion service, where a victim is induced to open the malicious file.
Heap out-of-bounds write in OpenJPH 0.32.0 and earlier allows memory corruption when the library decodes a crafted JPEG 2000 codestream (.j2c or .jph) that uses small precinct sizes to create degenerate one-row codeblocks; the HTJ2K cleanup-pass decoder then writes a second row beyond the end of the codeblock buffer, causing heap corruption and crashes. Publicly available exploit code exists, including a detailed technical write-up, but there is no indication of confirmed active exploitation (no CISA KEV listing), and the assessed attack vector is local with user interaction (CVSS 3.1 AV:L/AC:L/PR:N/UI:R, integrity impact low, availability impact high). Realistic exposure requires OpenJPH to sit in a decode path that accepts untrusted images, such as an upload handler, image viewer, or batch conversion service, where a victim is induced to open the malicious file.