jbig2imagecompose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
{ "urgency": "not yet assigned" }