https://seclists.org/oss-sec/2026/q4/44: openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (versible 5/3 forward DWT, encoder)
Affected Software
Frequently Asked Questions
Which uses of OpenJPEG are exposed to this issue?
The issue is in the encoder-side reversible 5/3 forward wavelet transform, specifically its vertical pass. It is relevant to applications that encode images, especially those that perform more than one encode in the same process.
Can a crafted image file trigger this during decoding?
No. The issue is not decoder-side and is reached through encoding parameters rather than a crafted input file.
What encoding conditions trigger the overflow?
A tile must have lower resolution levels with zero height at an odd start. A single encode may appear to succeed, while repeating the same encode in one process can expose the heap corruption.
How might an affected deployment fail?
When the same encode is repeated in one process, glibc heap checking can abort the process. This can affect programs that encode multiple images during their lifetime.
What can maintainers do if an updated package is unavailable?
Upstream was provided a four-line patch, but the repository README declares the project unmaintained. Packagers may need to carry the patch themselves; the referenced open pull request #1657 does not change this behavior when cherry-picked onto the tested git master revision.