OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.
CVSS Details
- CVSS 4.0 Base Score: 6.6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openjpegUpgrade qt6-qtwebengine | Dec 5, 2025 | Aug 5, 2025 |
| Debian | — | Upgrade openjpeg2 | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade openjpeg2-develUpgrade openjpeg2Upgrade openjpeg2-tools | Aug 19, 2025 | Aug 5, 2025 |
| Redhat_linux | — | Upgrade openjpeg2-develNo solution existsUpgrade openjpeg2-debugsourceUpgrade openjpeg2-debuginfoUpgrade openjpeg2-tools-debuginfoUpgrade openjpeg2-toolsUpgrade openjpeg2 | Jan 27, 2026 | Aug 5, 2025 |
| Rocky_linux | — | Upgrade openjpeg2Upgrade openjpeg2-develUpgrade openjpeg2-toolsUpgrade openjpeg2-debuginfoUpgrade openjpeg2-debugsourceUpgrade openjpeg2-tools-debuginfo | Feb 5, 2026 | Oct 3, 2025 |
| Suse | — | Upgrade chromiumUpgrade chromedriver | Dec 5, 2025 | Dec 5, 2025 |
| Ubuntu | — | Upgrade libopenjp2-7Upgrade libopenjp3d7 (Ubuntu Pro)Upgrade libopenjp2-7 (Ubuntu Pro)Upgrade libopenjp3d7 | Sep 22, 2025 | Sep 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub