CVE-2016-9113

Name of the Vulnerable Software and Affected Versions OpenJPEG version 2.1.2

Description The issue is related to a NULL pointer dereference in the imagetobmp function of convertbmp.c at line 980. Specifically, image->comps[0].data is not assigned a value after initialization, which remains NULL. This results in a Denial of Service impact.

Recommendations For OpenJPEG version 2.1.2, as a temporary workaround, consider disabling the imagetobmp function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.