OpenJPEG (2.4.0 - 2.5.4, Git Master Through 8314119b) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openjpeg-2.4.0---2.5.4-git-master-through-8314119b/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 25 Oct 2026 00:10:18 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenJPEG: Heap buffer overflow in opj_dwt_encode_and_deinterleave_v (CVE-2026-107080)https://feed.craftedsignal.io/briefs/2026-10-openjpeg-heap-overflow/Sun, 25 Oct 2026 00:10:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-openjpeg-heap-overflow/OpenJPEG versions 2.4.0 through 2.5.4 and current git master are vulnerable to a heap buffer overflow in the opj_dwt_encode_and_deinterleave_v function, which can be triggered during reversible 5/3 forward DWT encoding to cause a denial of service.OpenJPEG versions 2.4.0 through 2.5.4, and the git master branch up to commit 8314119b, contain an out-of-bounds read and write vulnerability in the opj_dwt_encode_and_deinterleave_v() function located in src/lib/openjp2/dwt.c. This heap buffer overflow occurs during the reversible 5/3 forward Discrete Wavelet Transform (DWT) encoding process. The vulnerability is currently unpatched in the upstream repository.

Impact

An attacker who can influence the input provided to the OpenJPEG encoder can trigger this heap buffer overflow, resulting in a denial of service (DoS) for the application utilizing the library.

Recommendation

  • Inventory applications and services in your environment that utilize the OpenJPEG library (versions 2.4.0 to 2.5.4).
  • Monitor upstream OpenJPEG development for the release of an official patch for CVE-2026-107080.
  • If the library is embedded, consider restricting input processing for untrusted JPEG 2000 images until a security update is applied.
]]>mediumadvisory