CVE-2012-3358

Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow...

10.0 HighFix available

CVE-2012-3358 is a high vulnerability (CVSS 10.0) in Uclouvain Openjpeg, published July 18, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.70%, the 94th percentile. Fixed in openjpeg 1.3+dfsg-4+squeeze1.

Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file.

Exploit likelihood

7.70%Up 2.2 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Record: CVE-2012-3358
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-3358
Updated: 2026-11-02

EUVDEUVD-2012-3335 No score

Record: EUVD-2012-3335
Updated: 2026-11-03

GitHub AdvisoriesGHSA-2m5h-fr2p-prrm No score

Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow...

Record: GHSA-2m5h-fr2p-prrm
Weakness: CWE-119
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10227-1 No score

libopenjpeg1-1.5.2-4.7 on GA media

These are all security issues fixed in the libopenjpeg1-1.5.2-4.7 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10227-1
Updated: 2026-11-02

Affected products

uclouvain openjpeg

Affected packages

Affected packages
Package	Affected	Fixed
`openjpeg` Debian:6.0	before 1.3+dfsg-4+squeeze1, plus listed versions 1.3+dfsg-4	1.3+dfsg-4+squeeze1
`openjpeg` Red Hat:enterprise_linux:6::client	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-debuginfo` Red Hat:enterprise_linux:6::client	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-libs` Red Hat:enterprise_linux:6::client	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-devel` Red Hat:enterprise_linux:6::client	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg` Red Hat:enterprise_linux:6::computenode	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-debuginfo` Red Hat:enterprise_linux:6::computenode	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-libs` Red Hat:enterprise_linux:6::computenode	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-devel` Red Hat:enterprise_linux:6::computenode	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg` Red Hat:enterprise_linux:6::server	before 0:1.3-8.el6_3	0:1.3-8.el6_3

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`openjpeg-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-libs` Red Hat:enterprise_linux:6::server	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-devel` Red Hat:enterprise_linux:6::server	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg` Red Hat:enterprise_linux:6::workstation	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-libs` Red Hat:enterprise_linux:6::workstation	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-devel` Red Hat:enterprise_linux:6::workstation	before 0:1.3-8.el6_3	0:1.3-8.el6_3

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 25 moreShow less