Security
OpenJPEG advisories
The JPEG 2000 codec, bundled inside Pillow's wheels and used by poppler for JPEG 2000 streams inside PDFs
6 advisories recorded for OpenJPEG (openjpeg2 on Debian); the project is at https://github.com/uclouvain/openjpeg. Newest first.
| Published | Advisory | Reaches you | What sillybos does |
|---|---|---|---|
| OpenJPEG's wavelet encoder reads and writes out of bounds CVE-2026-107080 | on a save path | Not reached by opening a file | |
| OpenJPEG's encoder overflows an integer in opj_pi_initialise_encode CVE-2026-6192 | on a save path | Not reached by opening a file | |
| OpenJPEG dereferences a null pointer in the wavelet transform CVE-2025-50952 | by opening a file | Refused by default | |
| A short JP2 stream makes OpenJPEG write out of bounds in opj_jp2_read_header CVE-2025-54874 | by opening a file | Refused by default | |
| opj_decompress overruns a heap buffer with certain options (second report) CVE-2024-56827 | through a command-line tool | Not reached by opening a file | |
| opj_decompress overruns a heap buffer with certain options CVE-2024-56826 | through a command-line tool | Not reached by opening a file |
Back to the whole watch.