Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-51807: OpenHTJ2K v.0.18.4 and earlier allows code execution via malicious data

CVE-2026-51807 CVE-2026-51807

Summary

OpenHTJ2K, a Java library for handling JPEG 2000 files, has a security issue that could allow an attacker to run unauthorized code on a system by sending it a specially crafted file. This is a serious issue because an attacker could potentially take control of the system or steal sensitive information. Users should update to the latest version of OpenHTJ2K to fix this issue.

Original title

Original description

Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validation before coding-pass lengths are written to j2k_codeblock::pass_length[128]. A crafted JPEG 2000 codestream containing malformed PPM packet headers can trigger a heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in source/core/coding/coding_units.cpp due to missing bounds validation for the j2k_codeblock::pass_length[128] array which can lead to heap corruption and process termination.

Vulnerability type

CWE-121 Stack-based Buffer Overflow

Published: 14 Jul 2026 · Updated: 18 Jul 2026 · First seen: 14 Jul 2026