CVE-2017-14152: A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0.

Security readout for executives and security teams

OpenJPEG 2.2.0 can mishandle specially formed JPEG 2000 processing parameters and write outside heap memory. A service or application that processes untrusted JPEG 2000 files could crash, and the CVE description says remote code execution may be possible. Exposure is most likely in applications, media pipelines, document converters, image upload services, or distributions that include OpenJPEG 2.2.0 or vulnerable backports. The bundle does not identify broader affected product lists or CPEs. Treat this as high priority where OpenJPEG processes untrusted files, especially on public upload or conversion services. The main business risk is service disruption, with possible code execution noted but not proven in the provided sources. Mitigation focus: Update OpenJPEG through the relevant operating system or vendor security channel.; For Debian systems, review and apply DSA-4013 guidance.; Verify whether the upstream fix commit is included in your deployed package..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.