The OpenHTJ2K library contains a critical buffer overflow vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the host system.

The vulnerability exists within the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded functions. It is a buffer overflow condition that can be triggered by providing malicious input to the decoder, potentially leading to arbitrary code execution.

With a CVSS score of 9.8, this vulnerability is classified as critical. Successful exploitation allows for full system compromise, including the execution of arbitrary code, which can lead to data theft, system downtime, and complete loss of control over the affected application.

Immediate Action: Update the OpenHTJ2K library to version v0.18.5 or later.

Proactive Monitoring: Monitor application performance and logs for crashes or unexpected execution patterns that may indicate attempts to exploit memory corruption vulnerabilities.

Compensating Controls: Use application sandboxing or memory protection features to limit the impact of code execution if an immediate update is not feasible.

Public Exploit Available: No

Given the critical CVSS score and the existence of a proof-of-concept, users of the OpenHTJ2K library must treat this as a high-priority remediation task. Updating to version v0.18.5 is the only effective way to mitigate this risk.