CVE-2019-5144

HIGH 8.8CVE-2019-5144 · Published 12/12/2019 · updated 17/06/2026

In short

CVE-2019-5144 is a HIGH (CVSS 8.8) vulnerability affecting kakadu software (kakadusoftware).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
kakadu software kakadusoftware	`= 7.10.2`	No fix yet

Description

An exploitable heap underflow vulnerability exists in the derive_taps_and_gains function in kdu_v7ar.dll of Kakadu Software SDK 7.10.2. A specially crafted jp2 file can cause a heap overflow, which can result in remote code execution. An attacker could provide a malformed file to the victim to trigger this vulnerability.

References

talosintelligence.com/vulnerability_reports/TALOS-2019-0933 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free