Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 6.5 · google, uclouvain, debianNVD modified 2026-10-08 14:56
Affected (CPE criteria) 3
cpe:2.3:a:google:chrome:-:*:*:*:*:*:*:*cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
References 6
- https://bugs.chromium.org/p/chromium/issues/detail?id=430891 Exploit
- https://bugs.chromium.org/p/chromium/issues/detail?id=457493 Exploit
- https://lists.debian.org/debian-lts-announce/2018/07/msg00025.html Third Party Advisory
- https://bugs.chromium.org/p/chromium/issues/detail?id=430891 Exploit
- https://bugs.chromium.org/p/chromium/issues/detail?id=457493 Exploit
- https://lists.debian.org/debian-lts-announce/2018/07/msg00025.html Third Party Advisory