CVE-2016-10504

Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG...

6.5 MediumPublic exploitFix available

Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

8.22%Down 2.0 points since Feb 4, 2022

What each source reports

NVD Score used 6.5

Record: CVE-2016-10504
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-10504
Updated: 2026-11-02

EUVDEUVD-2016-1686 No score

Record: EUVD-2016-1686
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9658-9wm2-ghj4 6.5

Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG...

Record: GHSA-9658-9wm2-ghj4
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSV 6.5

Record: CVE-2016-10504
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-10504 6.5

Record: DEBIAN-CVE-2016-10504
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-10504 6.5

Record: UBUNTU-CVE-2016-10504
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11120-1 No score

libopenjp2-7-2.4.0-1.4 on GA media

These are all security issues fixed in the libopenjp2-7-2.4.0-1.4 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11120-1
Updated: 2026-11-02

Affected products

uclouvain openjpeg

Affected packages

Affected packages
Package	Affected	Fixed
`openjpeg2` Debian:12	before 2.2.0-1	2.2.0-1
`openjpeg2` Debian:13	before 2.2.0-1	2.2.0-1
`openjpeg2` Debian:14	before 2.2.0-1	2.2.0-1
`openjpeg2` Ubuntu:16.04:LTS	before 2.1.2-1.1+deb9u2build0.1, plus listed versions 2.1.0-2.12.1.0-2.1ubuntu0.1	2.1.2-1.1+deb9u2build0.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	OpenJPEG - 'mqc.c' Heap Buffer Overflow	2017-09-01

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-10504 is a medium vulnerability (CVSS 6.5) in Uclouvain Openjpeg, published August 30, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.22%, the 94th percentile. Fixed in openjpeg2 2.2.0-1.

References

Show 28 moreShow less