OpenJPEG: Heap buffer overflow in opj_dwt_encode_and_deinterleave_v (CVE-2026-107080)
OpenJPEG versions 2.4.0 through 2.5.4 and current git master are vulnerable to a heap buffer overflow in the opj_dwt_encode_and_deinterleave_v function, which can be triggered during reversible 5/3 forward DWT encoding to cause a denial of service.
CVE search metadata
CVE search record: CVE-2026-107080. KEV: no. Product: OpenJPEG (2.4.0 - 2.5.4, git master through 8314119b). Brief: OpenJPEG: Heap buffer overflow in opj_dwt_encode_and_deinterleave_v (CVE-2026-107080). Brief link: https://feed.craftedsignal.io/briefs/2026-10-openjpeg-heap-overflow/
Triage facts
Revision 1- Applicability
- OpenJPEG (2.4.0 - 2.5.4, git master through 8314119b)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 00:10 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
OpenJPEG versions 2.4.0 through 2.5.4, and the git master branch up to commit 8314119b, contain an out-of-bounds read and write vulnerability in the opj_dwt_encode_and_deinterleave_v() function located in src/lib/openjp2/dwt.c. This heap buffer overflow occurs during the reversible 5/3 forward Discrete Wavelet Transform (DWT) encoding process. The vulnerability is currently unpatched in the upstream repository.
Impact
An attacker who can influence the input provided to the OpenJPEG encoder can trigger this heap buffer overflow, resulting in a denial of service (DoS) for the application utilizing the library.
Recommendation
- Inventory applications and services in your environment that utilize the OpenJPEG library (versions 2.4.0 to 2.5.4).
- Monitor upstream OpenJPEG development for the release of an official patch for CVE-2026-107080.
- If the library is embedded, consider restricting input processing for untrusted JPEG 2000 images until a security update is applied.
Threat Hunt
Identify applications using OpenJPEG library versions 2.4.0-2.5.4
Data: Software Bill of Materials (SBOM), Dependency scanning reports
Enrichment needed
- CVE-2026-107080 (CTI) Monitor for patch availability and vendor disclosure
Mitigations
Apply future security updates once the upstream fix for CVE-2026-107080 is merged and released
CVE-2026-107080