JPEG 2000 – Researchers find security hole in image codec

Researchers are warning about a newly discovered security vulnerability in a popular open-source JPEG 2000 parser that could let corrupted image files trigger remote code execution.

Cisco-owned security firm Talos warns that by embedding a malformed image file into a web page, PDF file, or email message, an attacker could gain control over the targeted system simply by the user loading the page or message in a vulnerable application.

The flaw itself (designated CVE-2016-8332) involves the mishandling of mcc data by the OpenJPEG library. This, in turn, leads to an out-of-bounds heap write that, if set up correctly, could allow attack code to be loaded and executed in memory.