CVE-2018-20846: Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG…

PriorityP422medium6.5CVSS 3.1

AVNACLPRNUIRSUCNINAH

EPSS

2.17%

80.2th percentile

Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	openjpeg2	< openjpeg2 2.3.1-1 (bookworm)	openjpeg2 2.3.1-1 (bookworm)
the_openjpeg_project	openjpeg2	>= 0 < 2.3.1-1	2.3.1-1
the_openjpeg_project	openjpeg2	>= 0 < 2.3.1-1	2.3.1-1
the_openjpeg_project	openjpeg2	>= 0 < 2.3.1-1	2.3.1-1
the_openjpeg_project	openjpeg2	>= 0 < 2.3.1-1	2.3.1-1
uclouvain	openjpeg	<= 2.3.0	—

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

osv6.5MEDIUM

vendor_debian6.5LOW

vendor_redhat6.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.