https://seclists.org/oss-sec/2026/q4/117: OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still psent in every lease (2.5.3, 2.5.4)
Published Oct 9, 2026
·Updated
Affected Software
1 affected component
OpenJPEG OpenJPEG=2.5.3, =2.5.4
Frequently Asked Questions
1
Which released versions are identified as still affected?
The report identifies OpenJPEG 2.5.3 and 2.5.4 as still containing the heap-buffer-overflow write.
2
Is a fix available upstream?
The issue is described as fixed on the master branch since February 2026. However, the repository is considered unmaintained, and the provided information does not identify a release containing the fix.
3
What should teams consider if they cannot move to a fixed upstream revision?
Because upstream states that no committer is currently responsible for regularly reviewing tickets or pull requests, teams should account for the lack of ongoing maintenance when assessing their dependency strategy. The provided information does not describe a workaround or mitigation.