CVE-2026-111151: OpenJPH may crash or be compromised by crafted images

The OpenJPH library (versions up to 0.32.0) can write beyond its memory limits when it decodes specially crafted .j2c or .jph image files with small precinct sizes. This can corrupt memory, cause the program to crash, or allow an attacker to take control. Upgrade to a newer version of OpenJPH or avoid processing untrusted image files to mitigate the risk.

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

• https://github.com/aous72/OpenJPH Product
• https://www.vulncheck.com/advisories/openjph-through-0.32.0-heap-out-of-bounds-w... Vendor Advisory
• https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/... Third Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-111151 Vendor Advisory
• https://github.com URL
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1111... Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-111151 Vendor Advisory
• https://ubuntu.com/security/CVE-2026-111151 Third Party Advisory
• https://www.cve.org/CVERecord?id=CVE-2026-111151 Third Party Advisory
• https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/... Third Party Advisory
• https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/... Third Party Advisory
• https://hackmd.io/@haind-pwn/openjph-htj2k-degenerate-codeblock-cleanup-oob-writ... Exploit