CVE-2020-27842

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-05 · updated 2026-06-17
Weakness: CWE-125

Description

There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.

Affected products

Debian Linux: 9.0, 10.0
Fedoraproject Extra Packages For Enterprise Linux: 7.0
Fedoraproject Fedora: 32, 33
Oracle Corporation Outside In Technology: 8.5.5
RedHat Codeready Linux Builder: 8.0
RedHat Codeready Linux Builder For Ibm Z Systems: 8.0
RedHat Codeready Linux Builder For Power Little Endian: 8.0
Red Hat Enterprise Linux: 8.0
RedHat Enterprise Linux For Ibm Z Systems: 8.0
RedHat Enterprise Linux For Power Little Endian: 8.0
uclouvain openjpeg: before 2.4.0 — fixed in 2.4.0

How to fix

Upgrade to a fixed version: uclouvain openjpeg 2.4.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-27842 or the next vulnerability affects your stack