CVE-2020-27845 in OpenJPEG
Summary
by MITRE • 01/06/2021
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/30/2026
The vulnerability identified within the OpenJPEG library prior to version 2.4.0 represents a critical security defect located in the source file src/lib/openjp2/pi.c, specifically affecting the Picture Index (PI) generation logic used during JPEG 2000 image processing operations. This flaw manifests when the application processes untrusted input through its conversion or encoding functionalities, triggering an out-of-bounds read condition. The root cause of this issue lies in improper boundary checks within the PI calculation routines, which fail to validate that memory access indices remain strictly within the allocated buffer limits before performing read operations. In complex JPEG 2000 streams, particularly those with irregular tile structures or malformed header data, these index calculations can result in values that exceed the bounds of the internal arrays used for tracking picture components and resolutions.
From a technical perspective, this vulnerability is classified under CWE-125, which denotes Out-of-bounds Read vulnerabilities. The exploitation vector typically involves an attacker crafting a malicious JPEG 2000 file with specific header parameters or tile data that forces the library to compute invalid memory offsets. When the application attempts to read from these calculated addresses, it accesses memory regions outside the intended buffer allocation. While out-of-bounds reads are often associated with information disclosure, in this specific context involving encoding and conversion functions, the primary consequence is not necessarily the leakage of sensitive data but rather the corruption of program state or immediate termination due to segmentation faults. The attacker does not require authentication if the application automatically processes uploaded images or decodes incoming streams from untrusted sources such as web uploads or network sockets.
The operational impact of this vulnerability centers heavily on availability, aligning with the ATT&CK technique T1499 Endpoint Denial of Service via Resource Exhaustion or other denial-of-service vectors that rely on application crashes. Because the flaw triggers an out-of-bounds read during critical encoding tasks, it can cause the hosting application to crash unexpectedly. In environments where OpenJPEG is used for real-time image processing, such as web servers handling user-uploaded avatars, document management systems converting files, or medical imaging software displaying DICOM streams containing JPEG 2000 data, a single malicious file can lead to service disruption. This denial of service affects the reliability and uptime of the affected system, potentially requiring manual intervention to restart services if automatic recovery mechanisms are not in place.
Mitigation strategies for this vulnerability primarily involve upgrading the OpenJPEG library to version 2.4.0 or later, where these boundary checks have been corrected by the maintainers. For organizations unable to immediately patch their dependencies, implementing strict input validation at the application layer can provide a secondary defense-in-depth measure. This includes validating JPEG 2000 headers against expected constraints before passing them to the library and configuring sandboxing mechanisms such as SELinux or AppArmor to limit the impact of potential crashes on the broader system. Additionally, deploying Web Application Firewalls with deep packet inspection capabilities for image uploads can help detect and block malformed files that exhibit patterns consistent with this exploitation attempt, thereby reducing the attack surface until a permanent code-level fix is deployed.