CVE-2017-14164

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-09-06 · updated 2026-06-17
Weakness: CWE-119

Description

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

Affected products

uclouvain openjpeg: before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: uclouvain openjpeg 2.3.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/100677
https://blogs.gentoo.org/ago/2017/09/06/heap-based-buffer-overflow-in-opj_write_bytes_le-cio-c-incomplete-fix-for-cve-2017-14152/
https://github.com/uclouvain/openjpeg/commit/dcac91b8c72f743bda7dbfa9032356bc8110098a
https://github.com/uclouvain/openjpeg/issues/991
https://security.gentoo.org/glsa/201710-26
http://www.securityfocus.com/bid/100677
https://blogs.gentoo.org/ago/2017/09/06/heap-based-buffer-overflow-in-opj_write_bytes_le-cio-c-incomplete-fix-for-cve-2017-14152/
https://github.com/uclouvain/openjpeg/commit/dcac91b8c72f743bda7dbfa9032356bc8110098a
https://github.com/uclouvain/openjpeg/issues/991
https://security.gentoo.org/glsa/201710-26

Get alerted when CVE-2017-14164 or the next vulnerability affects your stack