CVE-2024-56826: Openjpeg: heap buffer overflow in bin/common/color.c
A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opjdecompress utility. This can lead to an application crash or other undefined behavior.
Other sources
This bug is triggered when we use opjdecompress with the -r option and its argument set to 2. Version v2.5.2 also has this vulnerability.
Reproducible: Always
Steps to Reproduce: see https://github.com/uclouvain/openjpeg/issues/1563
References: https://github.com/uclouvain/openjpeg/issues/1563 https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8 https://bugzilla.redhat.com/showbug.cgi?id=2333954
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56826?
CVE-2024-56826 has been classified as a high severity vulnerability due to the potential for application crashes or undefined behaviors.
How do I fix CVE-2024-56826?
To mitigate CVE-2024-56826, upgrade OpenJPEG to version 2.5.0-3 or later.
Which versions of OpenJPEG are affected by CVE-2024-56826?
CVE-2024-56826 affects OpenJPEG versions up to and including 2.4.0-3 and 2.5.0-2.
What type of vulnerability is CVE-2024-56826?
CVE-2024-56826 is a heap buffer overflow vulnerability found in the OpenJPEG project.
What are the potential consequences of CVE-2024-56826?
The consequences of CVE-2024-56826 can include application crashes and undefined behavior in affected systems.