A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.
| Product | Vendor | Version |
|---|---|---|
| OpenJPEG | n/a | 9.16.4.42 |
| OpenJPEG | n/a | <= 5.15.* |