CVE-2020-27814

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-01-26 · updated 2026-06-17
Weakness: CWE-122

Description

A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.

Affected products

Debian Linux: 9.0, 10.0
uclouvain openjpeg: through 1.5.1; from 2.0.0 before 2.4.0 — fixed in 2.4.0

How to fix

Upgrade to a fixed version: uclouvain openjpeg 2.4.0. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1901998
https://github.com/uclouvain/openjpeg/issues/1283
https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
https://security.gentoo.org/glsa/202101-29
https://www.debian.org/security/2021/dsa-4882
https://www.oracle.com//security-alerts/cpujul2021.html
https://bugzilla.redhat.com/show_bug.cgi?id=1901998
https://github.com/uclouvain/openjpeg/issues/1283
https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
https://security.gentoo.org/glsa/202101-29
https://www.debian.org/security/2021/dsa-4882
https://www.oracle.com//security-alerts/cpujul2021.html

Get alerted when CVE-2020-27814 or the next vulnerability affects your stack