Description
OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aous72 | OpenJPH | ≤ 0.32.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openjph | 0.33.0-1 | — |
| Debian 13 | openjph | No fix yet | — |
| Debian 12 | openjph | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | openjph | No fix yet | — |
| Ubuntu 26.04 LTS | openjph | No fix yet | — |
| Ubuntu 24.04 LTS | openjph | No fix yet | — |
References
- https://hackmd.io/@haind-pwn/openjph-htj2k-degenerate-codeblock-cleanup-oob-write technical-description exploit
- https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/codestream/ojph_subband.cpp#L136-L142 technical-description
- https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/codestream/ojph_codeblock.cpp#L79-L84 technical-description
- https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/coding/ojph_block_decoder32.cpp#L1135-L1155 technical-description
- https://github.com/aous72/OpenJPH product
- VulnCheck Advisory: OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder third-party-advisory