CVE-2018-21010
openjpeg: heap buffer overflow in color_apply_icc_profile in bin/common/color.c
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · September 5, 2019
Updated · November 22, 2025
Description
A heap-based buffer overflow has been discovered in OpenJPEG in the function color_apply_icc_profile, while applying the color transformation. An application that uses OpenJPEG to parse untrusted images may be vulnerable to this flaw, which would allow an attacker to crash the application or potentially execute code.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
If the application accepts untrusted images there is no known mitigation apart from applying the patch.
CVSS / CWE
CVSS 3.0 · 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-122 · Heap-based Buffer Overflow