Medium
5.5
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v()...
CVE-2026-107080
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-107080 openjpeg2
Original description The description as published by the source.
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
Source: oss-security (Openwall) NVD GitHub Advisory
References
- advisory nvd.nist.gov
- advisory github.com
- OSS-SECURITY Re: openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder)
- patch github.com
- patch github.com
- REDHAT Red Hat
- report github.com
- web openwall.com
- web openwall.com
- web github.com