PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-4796 Fedoraproject CVE debrief

CVE-2016-4796 describes a heap-based buffer overflow in OpenJPEG’s color_cmyk_to_rgb path. A crafted .j2k file can trigger a crash, making this a denial-of-service issue for software that parses JPEG 2000 content. NVD rates it CVSS 5.5 (MEDIUM).

Vendor
Fedoraproject
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-03
Original CVE updated
2026-05-13
Advisory published
2017-02-03
Advisory updated
2026-05-13

Who should care

Teams running OpenJPEG directly, or applications and services that ingest untrusted .j2k / JPEG 2000 files, should care most. Fedora package maintainers and operators of Fedora 23/24 systems are also relevant because those CPEs are listed as vulnerable in the NVD record.

Technical summary

The NVD record states that color_cmyk_to_rgb in common/color.c in OpenJPEG before 2.1.1 contains a heap-based buffer overflow. The primary impact is availability: a crafted .j2k file can cause the application to crash. NVD’s CVSS v3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, and the listed weakness is CWE-119. The record also includes Fedora 23 and Fedora 24 CPEs as vulnerable targets.

Defensive priority

Medium. This is a denial-of-service vulnerability rather than a code-execution finding in the supplied record, but it affects file parsing paths that may be exposed to untrusted input. Prioritize if OpenJPEG is used in user-facing upload, preview, conversion, or batch-processing workflows.

Recommended defensive actions

  • Upgrade OpenJPEG to version 2.1.1 or later, as the vulnerability is listed for versions before 2.1.1.
  • If you ship or depend on Fedora packages, verify whether your Fedora 23/24 builds already include the vendor fix or backported patch.
  • Treat .j2k and other JPEG 2000 files as untrusted input and consider isolating parsing/conversion workloads.
  • Review any application paths that automatically open or preview JPEG 2000 content, especially where a crash would impact service availability.
  • Track downstream advisories and package announcements referenced in the CVE record for distribution-specific remediation guidance.

Evidence notes

The debrief is based on the NVD CVE record and the linked patch/advisory references supplied in the corpus. The record explicitly names OpenJPEG before 2.1.1, the vulnerable function color_cmyk_to_rgb in common/color.c, and a crafted .j2k file as the trigger. The NVD CVSS vector indicates AV:L/UI:R, while the prose description says remote attackers; this discrepancy is preserved as a record-quality note rather than resolved beyond the supplied sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-4796 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-4796

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-4796 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-4796

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.