MGASA-2021-0216

There is a flaw in the opj2compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability.

This flaw affects the opj2compress utility but is not in the openjpeg2 library. Therefore, the attack vector is local to the opj2compress utility and would require an attacker to convince a user to open a directory with an extremely large number of files using opj2compress, or a script to be feeding such arbitrary, untrusted files to opj2compress (CVE-2021-29338).