CVE-2016-1628
MEDIUMOpenJPEG <48.0.2564.109 - RCE
Title source: llmDescription
pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functions.
References (11)
Scores
CVSS v3
6.3
EPSS
0.0091
EPSS Percentile
75.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Classification
CWE
CWE-119
Status
draft
Affected Products (2)
google/chrome
< 48.0.2564.103
debian/debian_linux
Timeline
Published
Feb 21, 2016
Tracked Since
Feb 18, 2026