{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopenjpegopenjpeg2.5.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openjpeg:openjpeg:2.4.0:*:*:*:*:*:*:*","cpe:2.3:a:openjpeg:openjpeg:2.5.4:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-107080"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenJPEG (2.4.0 - 2.5.4, git master through 8314119b)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenJPEG"],"content_html":"\u003cp\u003eOpenJPEG versions 2.4.0 through 2.5.4, and the git master branch up to commit 8314119b, contain an out-of-bounds read and write vulnerability in the \u003ccode\u003eopj_dwt_encode_and_deinterleave_v()\u003c/code\u003e function located in \u003ccode\u003esrc/lib/openjp2/dwt.c\u003c/code\u003e. This heap buffer overflow occurs during the reversible 5/3 forward Discrete Wavelet Transform (DWT) encoding process. The vulnerability is currently unpatched in the upstream repository.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker who can influence the input provided to the OpenJPEG encoder can trigger this heap buffer overflow, resulting in a denial of service (DoS) for the application utilizing the library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory applications and services in your environment that utilize the OpenJPEG library (versions 2.4.0 to 2.5.4).\u003c/li\u003e\n\u003cli\u003eMonitor upstream OpenJPEG development for the release of an official patch for CVE-2026-107080.\u003c/li\u003e\n\u003cli\u003eIf the library is embedded, consider restricting input processing for untrusted JPEG 2000 images until a security update is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T00:10:18Z","date_published":"2026-10-25T00:10:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-openjpeg-heap-overflow/","summary":"OpenJPEG versions 2.4.0 through 2.5.4 and current git master are vulnerable to a heap buffer overflow in the opj_dwt_encode_and_deinterleave_v function, which can be triggered during reversible 5/3 forward DWT encoding to cause a denial of service.","title":"OpenJPEG: Heap buffer overflow in opj_dwt_encode_and_deinterleave_v (CVE-2026-107080)","url":"https://feed.craftedsignal.io/briefs/2026-10-openjpeg-heap-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:openjpeg:openjpeg:2.5.4:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}