Tetrak
GitHub ↗
Security · OpenJPEG

OpenJPEG's wavelet encoder reads and writes out of bounds

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c.

Advisory
CVE-2026-107080
Library
OpenJPEG, openjpeg2 on Debian
Published
Severity
6.5 out of 10, as published
Affected
OpenJPEG 2.4.0 through 2.5.4
Fixed in
see the upstream record
Reaches you
on a save path

What triggers it

Encoding a JPEG 2000 image that reaches opj_dwt_encode_and_deinterleave_v.

What sillybos does

Not reached by opening a file

Opening or reading a file never reaches this flaw, so a check before decoding has nothing to refuse. Listed so that nobody expects it to.

In the encoder's wavelet transform, run on whatever image the program chooses to encode as JPEG 2000; no file carries the trigger, and a JPEG 2000 file handed to the check is refused by name in any case.

Proposed from the advisory's text on 2026-11-01, as part of folding the backfill into the record; confirmed by a person on 2026-11-03. Re-read on 2026-11-03: no file carries the trigger.

How to protect yourself

In general. Upgrade OpenJPEG to a version that has the fix; the upstream record names it.

Specifically. Not a pre-decode matter: the flaw is on a save path.

The general advice applies to every row here.

Sources