CVE-2014-7947: OpenJPEG before r2944, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to c...

Security readout for executives and security teams

This CVE is a remote denial-of-service issue in OpenJPEG used by PDFium in older Google Chrome builds. A malicious PDF could trigger an out-of-bounds read and crash the affected parser or browser process. The sources do not indicate data theft, code execution, or active exploitation. Exposure is most likely in legacy Chrome versions before 40.0.2214.91 or applications using vulnerable OpenJPEG/PDFium code. Modern managed browsers are unlikely to remain affected, but embedded PDF rendering stacks and old Linux packages should be checked. Prioritize remediation for any legacy or embedded PDF-processing systems still using old OpenJPEG/PDFium. For fully modern managed browsers, urgency is lower, but unresolved legacy exposure can still create reliability and availability risk from malicious PDFs. Mitigation focus: Upgrade Chrome to 40.0.2214.91 or later where applicable.; Update OpenJPEG to r2944 or a vendor-patched package.; Apply relevant Gentoo, openSUSE, or Red Hat security advisories if those packages are present..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.