CVE-2016-9115: Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2.

Security readout for executives and security teams

CVE-2016-9115 is a heap buffer over-read in OpenJPEG 2.1.2 when handling a crafted J2K file. The reported impact is denial of service, and exploitation requires someone or some service to open the malicious file. No source in the bundle reports active exploitation or a CVSS score. Exposure is most likely where OpenJPEG 2.1.2 processes untrusted JP2/J2K image files, including upload pipelines, conversion utilities, scanners, or desktop workflows that open external image attachments. Address this on systems that process external images, especially automated upload or conversion services. Business risk is service disruption rather than confirmed data theft or code execution, based on the supplied evidence. Mitigation focus: Identify systems and applications using OpenJPEG 2.1.2.; Check OpenJPEG, distro, and Gentoo guidance for fixed package versions.; Reduce or block untrusted J2K processing until remediated..

Prepared

Jun 13, 2026, 13:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.