Description
Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openjpeg2 | 2.2.0-1 | — |
| Debian 13 | openjpeg2 | 2.2.0-1 | — |
| Debian 12 | openjpeg2 | 2.2.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | openjpeg2 | 2.1.2-1.1+deb9u5build0.16.04.1 | — |
| Ubuntu 14.04 LTS | openjpeg | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | openjpeg2 | 2.3.0-2ubuntu0.1~esm1 | USN-4782-1 |
| Ubuntu Pro 16.04 LTS | openjpeg | 1:1.5.2-3.1ubuntu0.1~esm2 | USN-5664-1 |
| Ubuntu Pro 16.04 LTS | openjpeg2 | 2.1.2-1.1+deb9u6ubuntu0.1~esm1 | USN-4782-1 |
Advisories 2
- USN-5664-1 openjpeg vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-4782-1 openjpeg2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
References
- 100573 vdb-entry
- https://github.com/uclouvain/openjpeg/commit/d27ccf01c68a31ad62b33d2dc1ba2bb1eeaafe7b
- GLSA-201710-26 vendor-advisory
- https://github.com/uclouvain/openjpeg/issues/779
- https://github.com/uclouvain/openjpeg/issues/732
- https://github.com/uclouvain/openjpeg/issues/780
- https://github.com/uclouvain/openjpeg/issues/777
- https://github.com/uclouvain/openjpeg/issues/731
- https://github.com/uclouvain/openjpeg/issues/778