Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.3

OpenJPEG up to 2.5.4 allows local data corruption

published 2 months ago
Summary

A bug in OpenJPEG library can cause data corruption when an attacker has local access to a system. This could potentially lead to data loss or system instability. To fix this issue, update OpenJPEG to a version newer than 2.5.4 or apply the provided patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Julia juliabinarywrappers openjpeg_jll All versions
Original advisory text
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function...
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function `opj_pi_initialise_encode` in the library `src/lib/openjp2/pi.c`. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.3 Medium
Timeline
Published12 Aug 2026
Updated12 Aug 2026
First seen12 Aug 2026
Sources
JLSEC-2026-1267 · OSV
Track software like this
Free during beta