OpenImageIO versions before 3.0.18.0 and between 3.1.4.0-beta and 3.1.13.0 contain an integer overflow vulnerability in the jpeg2000input.cpp file. The buffer size is computed using signed 32-bit arithmetic (bufsize = w * h * ch * buffer_bpp), which can overflow when the product exceeds INT_MAX, causing the buffer size to wrap to zero or a small value. This results in an undersized buffer allocation by m_buf.resize(), leading to a heap overflow when pixel data is written. The vulnerability is conditional on the USE_OPENJPH build flag. The issue is fixed in OpenImageIO versions 3.0.18.0 and 3.1.13.0.

The integer overflow causes an undersized buffer allocation, which leads to a heap overflow during pixel write operations. This can result in memory corruption, potentially allowing an attacker to cause a denial of service or execute arbitrary code under certain conditions. The vulnerability requires local access (AV:L) and user interaction (UI:A), with low attack complexity (AC:L) and no privileges required (PR:N).

A fix is available in OpenImageIO versions 3.0.18.0 and 3.1.13.0. Users should upgrade affected versions to these fixed releases to remediate the vulnerability. No vendor advisory content contradicts this; therefore, upgrading to the patched versions is the recommended mitigation.