LiveActive security incident?Get immediate response
CVE Record

CVE-2020-15389: jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix...

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

OpenJPEG through 2.3.1 can mishandle memory while decompressing a directory containing both valid and invalid files. A crash or memory-safety failure could affect systems that process JPEG 2000 content, especially automated conversion or upload pipelines.

Executive priority

Treat this as a targeted remediation item for image-processing systems, not an internet-wide emergency. Prioritize platforms that process externally supplied JPEG 2000 files or run automated decompression jobs.

Technical view

The issue is a use-after-free in jp2/opj_decompress.c, related to opj_image_destroy being called twice. The CVE description says double-free may also be possible. Published affected metadata is sparse, but the description names OpenJPEG through 2.3.1.

Likely exposure

Exposure is most likely where OpenJPEG or openjpeg2 is installed and used to decompress untrusted JPEG 2000 files or batch-process directories. Exact product and CPE mappings are not provided in the bundle.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation claims. The described trigger involves decompression over a directory mixing valid and invalid files, not ordinary network reachability by itself.

Researcher notes

Evidence is incomplete: no CVSS, CWE, CPE, fixed upstream version, or active exploitation statement is included. The actionable technical detail is the opj_decompress image lifetime bug and vendor security advisories.

Mitigation direction

  • Apply OpenJPEG or openjpeg2 security updates from your operating system or vendor channel.
  • Use Debian, Gentoo, and Oracle advisories where those platforms apply.
  • Check current vendor guidance if no fixed version is named for your platform.
  • Restrict untrusted JPEG 2000 batch processing until patched.
  • Reduce automated processing of mixed user-controlled file directories.

Validation and detection

  • Inventory hosts and applications using OpenJPEG or openjpeg2.
  • Check whether installed OpenJPEG versions are through 2.3.1.
  • Confirm applicable Debian, Gentoo, or Oracle security updates are installed.
  • Identify workflows that decompress user-supplied JPEG 2000 files.
  • Review batch conversion jobs that process whole directories.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-15389 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.