{"id":"CVE-2026-107080","kind":"vulnerability","aliases":["CVE-2026-107080"],"related":[],"title":"OpenJPEG: out-of-bounds read and write in DWT encoder causes denial of service","description":"OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.","summary":"OpenJPEG 2.4.0 through 2.5.4 and git master through commit 8314119b have an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. An attacker can use it to crash the process, causing a denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c-libraries","image-processing","openjpeg","package"],"not_affected_if":["decode-only-use","unaffected-version"],"how_to_check":"- Check the installed OpenJPEG version with `opj_decompress -h` or your package manager, and compare against `2.4.0` through `2.5.4`.\n- Check whether your build includes commit `8314119b` or later from git master.","fix":"- Upgrade OpenJPEG to a version later than `2.5.4` once a patched release is confirmed (unknown in the sources).","status":"open","published_at":"2026-10-26T16:17:10+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:33:17+00:00","updated_at":"2026-10-26T16:33:17+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T16:33:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenJPEG to a version later than `2.5.4` once a patched release is confirmed (unknown in the sources).","reach":"unknown","title":"OpenJPEG: out-of-bounds read and write in DWT encoder causes denial of service","impact":"low","summary":"OpenJPEG 2.4.0 through 2.5.4 and git master through commit 8314119b have an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. An attacker can use it to crash the process, causing a denial of service.","category":"package","nicknames":[],"who_cares":["openjpeg","image-processing","c-libraries"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Denial of service through a crash from memory corruption","analyst_note":"Confirm the patched version and whether the encode path is reachable from untrusted input; check the upstream OpenJPEG advisory or commit history for the fix.","how_to_check":"- Check the installed OpenJPEG version with `opj_decompress -h` or your package manager, and compare against `2.4.0` through `2.5.4`.\n- Check whether your build includes commit `8314119b` or later from git master.","needs_analyst":true,"not_affected_if":["decode-only-use","unaffected-version"],"who_is_affected":"Applications that encode JPEG 2000 images with OpenJPEG versions 2.4.0 through 2.5.4, or git master builds through commit 8314119b, are exposed. The flawed function is in the DWT encode path, so systems that only decode images or use other libraries are less likely to be affected. The sources do not say which applications expose the encoder to untrusted input.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3322,"output_tokens":632,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107080':18A,21A '-2026':17A,20A '2.4.0':31B,73C '2.5.4':33B,75C '8314119b':39B,81C 'allow':101C 'attack':59B,103C 'bound':5A,45B,87C 'c':23B 'c-librari':22B 'caus':12A,67B,105C 'commit':38B,80C 'contain':82C 'crash':64B 'cve':16A,19A 'deinterleav':54B,96C 'denial':13A,69B,107C 'dwt':10A,51B,93C 'encod':11A,52B,94C 'git':35B,77C 'imag':26B 'image-process':25B 'librari':24B 'master':36B,78C 'openjpeg':1A,28B,30B,72C 'opj':50B,92C 'out-of-bound':2A,42B,84C 'packag':29B 'process':27B,66B 'read':6A,46B,88C 'servic':15A,71B,109C 'src/lib/openjp2/dwt.c':57B,99C 'use':61B 'v':55B,97C 'write':8A,48B,90C","nicknames":[],"mitigations":[],"who_affected":"Applications that encode JPEG 2000 images with OpenJPEG versions 2.4.0 through 2.5.4, or git master builds through commit 8314119b, are exposed. The flawed function is in the DWT encode path, so systems that only decode images or use other libraries are less likely to be affected. The sources do not say which applications expose the encoder to untrusted input.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107080","severity":null,"published_at":"2026-10-26T16:17:10+00:00","modified_at":"2026-10-26T16:17:10+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}