Vulnerability record · CVE-2016-10504 · published 30 August 2017

CVE-2016-10504: Uclouvain openjpeg memory buffer overflow vulnerability

UUclouvain · Openjpeg

Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.

6.5 CVSS 3.0 Medium EPSS 8.2% · top 5.3% CWE-119 · Memory buffer overflow

6.5CVSS 3.0 base score, v2 4.3

8.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

12References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

UOpenjpeg Uclouvain

References

Link	Tags
http://www.debian.org/security/2017/dsa-4013
http://www.securityfocus.com/bid/100564
https://github.com/uclouvain/openjpeg/commit/397f62c0a838e15d667ef50e27d5d011d2c79c04	Issue TrackingPatchThird Party Advisory
https://github.com/uclouvain/openjpeg/issues/835	Issue TrackingPatchThird Party Advisory
https://security.gentoo.org/glsa/201710-26
https://www.exploit-db.com/exploits/42600/
http://www.debian.org/security/2017/dsa-4013
http://www.securityfocus.com/bid/100564
https://github.com/uclouvain/openjpeg/commit/397f62c0a838e15d667ef50e27d5d011d2c79c04	Issue TrackingPatchThird Party Advisory
https://github.com/uclouvain/openjpeg/issues/835	Issue TrackingPatchThird Party Advisory
https://security.gentoo.org/glsa/201710-26
https://www.exploit-db.com/exploits/42600/

Track CVE-2016-10504 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2013-4289Uclouvain openjpeg vulnerabilityMultiple integer overflows in lib/openjp3d/jp3d.c in OpenJPEG before 1.5.2 allow remote attackers to have unspecified impact and vectors, which trigg…EPSS 2.8%18 Apr 2014 10.0CVE-2013-4290Uclouvain openjpeg memory buffer overflow vulnerabilityStack-based buffer overflow in OpenJPEG before 1.5.2 allows remote attackers to have unspecified impact via unknown vectors to (1) lib/openjp3d/opj_j…EPSS 3.0%18 Apr 2014 10.0CVE-2012-3358Uclouvain openjpeg memory buffer overflow vulnerabilityMultiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (appli…EPSS 7.7%18 Jul 2012 9.8CVE-2018-7648Uclouvain openjpeg memory buffer overflow vulnerabilityAn issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when…EPSS 1.6%2 Mar 2018 9.8CVE-2017-17479Uclouvain openjpeg out-of-bounds write vulnerabilityIn OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-boun…EPSS 4.2%8 Dec 2017 9.8CVE-2017-17480Uclouvain openjpeg out-of-bounds write vulnerabilityIn OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bou…EPSS 5.1%8 Dec 2017 9.8CVE-2015-8871Debian linux use after free vulnerabilityUse-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact v…EPSS 3.0%21 Sep 2016 9.3CVE-2012-1499Uclouvain openjpeg memory buffer overflow vulnerabilityThe JPEG 2000 codec (jp2.c) in OpenJPEG before 1.5 allows remote attackers to execute arbitrary code via a crafted palette index in a CMAP record of …EPSS 5.1%11 Apr 2012

Source: NIST National Vulnerability Database (record CVE-2016-10504), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.