CVE-2016-5139

Severity: high (CVSS 7.6 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-08-07 · updated 2026-06-17
Weakness: CWE-119

Description

Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.

Affected products

Google Chrome: 52.0.2743.82

References

http://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00006.html
http://rhn.redhat.com/errata/RHSA-2016-1580.html
http://rhn.redhat.com/errata/RHSA-2017-0559.html
http://rhn.redhat.com/errata/RHSA-2017-0838.html
http://www.debian.org/security/2016/dsa-3645
http://www.securityfocus.com/bid/92276
http://www.securitytracker.com/id/1036547
https://codereview.chromium.org/2124073003
https://crbug.com/625541
https://lists.debian.org/debian-lts-announce/2018/07/msg00025.html

Get alerted when CVE-2016-5139 or the next vulnerability affects your stack