CVE-2018-5785

Name of the Vulnerable Software and Affected Versions OpenJPEG version 2.3.0

Description The issue is related to an integer overflow caused by an out-of-bounds left shift in the opj j2k setup encoder function. This can be exploited by remote attackers to cause a denial of service via a crafted bmp file.

Recommendations For OpenJPEG version 2.3.0, consider disabling the opj j2k setup encoder function as a temporary workaround until a patch is available. Restrict access to handling crafted bmp files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.