CVE-2017-12982: Uclouvain Openjpeg

Medium severity, CVSS 5.5. EPSS: 2.9% chance of exploitation in the next 30 days.

The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c, related to the opj_aligned_alloc_n function in opj_malloc.c.

Affected products

• Uclouvain Openjpeg: before 2.3.0 (fixed in 2.3.0)

Published 2017-08-21. Last modified 2026-06-17.