CVE-2024-56826 Openjpeg: heap buffer overflow in bin/common/color.c
A heap buffer overflow in OpenJPEG's decompression utility can cause application crashes or undefined behavior when processing specific options.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-56826?
CVE-2024-56826 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 9 Jan 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
Weakness: CWE-122
Which versions are affected by CVE-2024-56826?
Linux distribution packages (5)
openjpeg2 SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 2.3.0-150000.3.18.1 |
openjpeg2 SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 2.3.0-150000.3.18.1 |
openjpeg2 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.1.0-4.21.1 |
openjpeg2 openSUSE:Leap 15.6 | All versions | 2.3.0-150000.3.18.1 |
openjpeg2 openSUSE:Tumbleweed | All versions | 2.5.3-2.1 |
How do I fix CVE-2024-56826?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-56826 being exploited?
There is no known exploitation of CVE-2024-56826 in the wild and no public exploit code.
Sources
Also known as AZL-55450, AZL-55454, BELL-CVE-2024-56826, DEBIAN-CVE-2024-56826, GHSA-75jh-69xw-fw3p, OESA-2025-1031 and 4 more.