Live › vulnerability › CVE-2026-107080
Go to dashboardOpenJPEG 2.4.0 through 2.5.4 and git master through commit 8314119b have an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. An attacker can use it to crash the process, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Applications that encode JPEG 2000 images with OpenJPEG versions 2.4.0 through 2.5.4, or git master builds through commit 8314119b, are exposed. The flawed function is in the DWT encode path, so systems that only decode images or use other libraries are less likely to be affected. The sources do not say which applications expose the encoder to untrusted input.
No product ranges from the sources yet.
opj_decompress -h or your package manager, and compare against 2.4.0 through 2.5.4.8314119b or later from git master.2.5.4 once a patched release is confirmed (unknown in the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-107080")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.