CVE-2016-9112

What it actually does

The flaw triggers a floating-point exception (divide-by-zero) inside opj_pi_next_cprl at openjp2/pi.c:523 when a malformed JPEG2000 codestream is parsed, causing the calling process to terminate abnormally.

Why it matters to the business

Systems that decode untrusted JPEG2000 images experience sudden application or service crashes, producing denial-of-service conditions and potential loss of image-processing availability until the process is restarted.

How an attack unfolds

An attacker crafts a minimal JPEG2000 file whose tile or precinct geometry produces a zero divisor in the progression-order iterator; the file is supplied to any application linked against the vulnerable OpenJPEG library, which crashes on first decode attempt.

How to fix it

Upgrade the OpenJPEG library to a version containing the fix for CVE-2016-9112 (2.1.3 or later) and rebuild all dependent applications; where upgrades are impossible, reject untrusted JPEG2000 content or wrap the decoder in a crash-isolated sandbox.

How to confirm the fix worked

Confirm the installed libopenjp2.so (or equivalent) reports version 2.1.3 or newer; execute the original proof-of-concept file against the patched build and verify the process no longer terminates with SIGFPE.

Typical attack path

1. Generate a specially malformed JP2/J2K codestream that forces a zero divisor in opj_pi_next_cprl
2. Deliver the file to the target via network upload, email attachment, web page, or any other untrusted image ingestion path
3. Victim application calls the OpenJPEG decode routine on the file
4. Divide-by-zero exception is raised and the process aborts

How to detect it

Monitor process crash logs for SIGFPE or floating-point exceptions originating from libopenjp2 or openjp2.dll; correlate with recent receipt of JPEG2000 files in application or web-server logs.

What your security team should do

• Immediately inventory all hosts and containers that ship or link against OpenJPEG 2.1.2 or earlier
• Prioritize patching of any internet-facing image-processing services or document viewers
• Add OpenJPEG to the organization's vulnerability exception watch list until all instances are updated