CVE-2009-5030: Uclouvain Openjpeg

Medium severity, CVSS 6.8. EPSS: 4.1% chance of exploitation in the next 30 days.

The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."

Affected products

• Uclouvain Openjpeg: version 1.3 only; version 1.4 only; version 1.5 only

Published 2012-07-18. Last modified 2026-06-16.