What the vulnerability does

01Description

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

Key dates

02Disclosure timeline

March 4, 2022 CVE published
November 3, 2025 Record updated