CVE-2026-107080: OpenJPEG OpenJPEG vulnerability

Q: Which deployments are affected?

OpenJPEG versions 2.4.0 through 2.5.4 are affected. Git master is also affected through commit 8314119b.

Q: What outcome can an attacker achieve?

The out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() can be used to cause a denial of service.

Q: Is there an identified fix?

The provided references include commit a38e970fa59abd796c703ec469e578b09f7ffa33, which is associated with the issue and pull request.

Published Oct 26, 2026

Updated

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opjdwtencodeanddeinterleavev() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.

Affected Software

1 affected component

OpenJPEG OpenJPEG>=2.4.0<=2.5.4, <=8314119b

Event History

Oct 26, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are affected?

OpenJPEG versions 2.4.0 through 2.5.4 are affected. Git master is also affected through commit 8314119b.

What outcome can an attacker achieve?

The out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() can be used to cause a denial of service.

Is there an identified fix?

The provided references include commit a38e970fa59abd796c703ec469e578b09f7ffa33, which is associated with the issue and pull request.

CVE-2026-107080: OpenJPEG OpenJPEG vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What outcome can an attacker achieve?

Is there an identified fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What outcome can an attacker achieve?

Is there an identified fix?