CVE-2026-107080

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opjdwtencodeanddeinterleavev in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service...

PT-2026-123399

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj dwt encode and deinterleave v in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service...

CVE-2026-107080

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opjdwtencodeanddeinterleavev in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service...

CVE-2026-107080

The OpenJPEG library, specifically versions 2.4.0 through 2.5.4 and git master through commit 8314119b , is vulnerable to an out-of-bounds read and write in the opj_dwt_encode_and_deinterleave_v() function located in src/lib/openjp2/dwt.c. The flaw occurs during the encoder's discrete wavelet tra...

EUVD-2026-109960

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opjdwtencodeanddeinterleavev in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the opjj2kreadsod function in the bundled OpenJPEG library when processing a malicious JPEG 2000 image. The function writes to tpindex without first verifying that the pointer is non-null and that lcurrenttilepar...

Astra Linux – vulnerability in openjpeg2

A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opjdecompress utility. This can lead to an application crash or other undefined behavior...

Astra Linux – Vulnerability in openjpeg2

A flaw was discovered in OpenJPEG’s encoder. This flaw allows an attacker to provide specially crafted x,y offset inputs to OpenJPEG during encoding. The greatest threat of this vulnerability is to confidentiality, integrity, and system availability...

Astra Linux – Vulnerability in openjpeg2

There is a flaw in OpenJPEG’s T2 encoder in versions prior to 2.4.0. An attacker who can provide crafted input for OpenJPEG to process may cause a null pointer dereferencing. The most significant impact of this flaw is the availability of the application...

Astra Linux – Vulnerability in openjpeg2

There is a flaw in the src/lib/openjp2/pi.c file of openjpeg in versions prior to 2.4.0. If an attacker can provide untrusted input to openjpeg’s conversion/encoding functionality, they could cause an out-of-bounds read. The most significant impact of this flaw is the application’s availability...

Astra Linux – Vulnerability in openjpeg2

A flaw was discovered in OpenJPEG’s encoder, specifically in the opjdwtcalcexplicitstepsizes function. This flaw allows an attacker who can provide crafted inputs for the decomposition levels to cause a buffer overflow. The greatest threat of this vulnerability is to system availability...

Astra Linux – vulnerability in openjpeg2

A flaw was found in OpenJPEG. Maliciously crafted images can cause the program to enter an infinite loop and continuously print warning messages to the terminal...

Astra Linux – Vulnerability in openjpeg2

A flaw was discovered in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, resulting in an out-of-bounds read. The greatest threat from this vulnerability is system availability...

Astra Linux – Vulnerability in openjpeg2

In OpenJPEG 2.3.1, there is excessive iteration in the opjt1encodecblks function of openjp2/t1.c. Remote attackers could exploit this vulnerability to cause a denial of service by using a crafted BMP file. This issue is similar to CVE-2018-6616...

Astra Linux – vulnerability in openjpeg2

An integer overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, resulting in a Denial of Service DoS condition. This occurs when an attacker uses the command-line option “-ImgDir” on a directory containing 1,048,576 files...

EulerOS 2.0 SP11 : openjpeg2 (EulerOS-SA-2026-4352)

According to the versions of the openjpeg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opjpiinitialiseencode in the library...

WS-2026-0126

OpenJPEG 2.5.3 and 2.5.4: opjj2kreadsod in src/lib/openjp2/j2k.c writes to the tile-part index array tpindexcurrenttilepart without a bounds check when a valid TLM marker causes readsot to skip resizing it, so a crafted JPEG 2000 codestream triggers a heap buffer overflow write while decoding...

WS-2026-0127

OpenJPEG 2.4.0 through 2.5.4: opjdwtencodeanddeinterleavev in src/lib/openjp2/dwt.c reversible 5/3 forward DWT, encoder performs heap out-of-bounds reads and writes when a resolution level has zero height at an odd start coordinate, reachable when encoding attacker-influenced image parameters...

Rocky Linux 8 [CIQ] Security Update: openjpeg2 / openjpeg2-debuginfo / openjpeg2-debugsource / etc Multiple Vulnerabilities (crlsa-2021_4251)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214251 advisory. openjpeg: use-after-free and double-free via a mix of valid and invalid files in a directory operated on by the decompressor CVE-2020-15389 openjpeg:...

Rocky Linux 9 [CIQ] Security Update: openjpeg2 / openjpeg2-debuginfo / openjpeg2-debugsource / etc Multiple Vulnerabilities (crlsa-2025_7309)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257309 advisory. openjpeg: heap buffer overflow in bin/common/color.c CVE-2024-56826 openjpeg: heap buffer overflow in lib/openjp2/j2k.c CVE-2024-56827 Tenable has extracte...