CVE-2009-5030

The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to...

6.8 MediumFix available

CVE-2009-5030 is a medium vulnerability (CVSS 6.8) in Uclouvain Openjpeg, published July 18, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.06%, the 90th percentile. Fixed in openjpeg 1.3+dfsg-4+squeeze1.

The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."

Exploit likelihood

4.06%Down 2.5 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2009-5030
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-5030
Updated: 2026-11-02

EUVDEUVD-2009-4988 No score

Record: EUVD-2009-4988
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5f2v-78x3-pvgj No score

The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to...

Record: GHSA-5f2v-78x3-pvgj
Weakness: CWE-119
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10227-1 No score

libopenjpeg1-1.5.2-4.7 on GA media

These are all security issues fixed in the libopenjpeg1-1.5.2-4.7 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10227-1
Updated: 2026-11-02

Affected products

uclouvain openjpeg

Affected packages

Affected packages
Package	Affected	Fixed
`openjpeg` Debian:6.0	before 1.3+dfsg-4+squeeze1, plus listed versions 1.3+dfsg-4	1.3+dfsg-4+squeeze1
`openjpeg` Red Hat:enterprise_linux:6::client	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-debuginfo` Red Hat:enterprise_linux:6::client	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-libs` Red Hat:enterprise_linux:6::client	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-devel` Red Hat:enterprise_linux:6::client	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg` Red Hat:enterprise_linux:6::computenode	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-debuginfo` Red Hat:enterprise_linux:6::computenode	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-libs` Red Hat:enterprise_linux:6::computenode	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-devel` Red Hat:enterprise_linux:6::computenode	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg` Red Hat:enterprise_linux:6::server	before 0:1.3-8.el6_3	0:1.3-8.el6_3

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`openjpeg-debuginfo` Red Hat:enterprise_linux:6::server	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-libs` Red Hat:enterprise_linux:6::server	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-devel` Red Hat:enterprise_linux:6::server	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg` Red Hat:enterprise_linux:6::workstation	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-libs` Red Hat:enterprise_linux:6::workstation	before 0:1.3-8.el6_3	0:1.3-8.el6_3
`openjpeg-devel` Red Hat:enterprise_linux:6::workstation	before 0:1.3-8.el6_3	0:1.3-8.el6_3

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 29 moreShow less