Zero Radar
← feed
HighVulnerabilityCVE-2026-107080updated 27 Oct 2026, 12:53 UTC

OpenJPEG image library can crash when encoding images

A flaw in the OpenJPEG image library can let an attacker crash programs that encode JPEG 2000 images. The program stops working until it is restarted.

No fix yetOfficial, 4 sources
SeverityHighCVSS 6.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Not yetUse the workaround below until a patch ships
How sure is this?Official, 4 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSubmits crafted image for encoding
  2. 2EncoderUses OpenJPEG forward DWT
  3. 3OverflowOut-of-bounds read and write in dwt.c
  4. 4CrashService stops responding
  5. ResultDenial of service on encoding service

What happened

An out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in the encoder's reversible 5/3 forward DWT (src/lib/openjp2/dwt.c) can cause a heap buffer overflow in OpenJPEG 2.4.0 through 2.5.4 and git master up to commit 8314119b.

Why it is dangerous: An attacker can cause a denial of service, making software that uses OpenJPEG to encode images crash or hang. Services that accept untrusted images for encoding are most at risk.

Are you affected?

You are affected if you run OpenJPEG 2.4.0 through 2.5.4 or git master through commit 8314119b, especially in services that encode user-supplied images.

OpenJPEG 2.4.0 through 2.5.4; git master through commit 8314119b

What to do

  1. Check whether your software uses OpenJPEG 2.4.0 through 2.5.4 or git master through commit 8314119b
  2. Limit or isolate image encoding of untrusted input until a fix is available
  3. Watch the OpenJPEG project and your software vendor for an updated release

Timeline

  1. 24 Oct 2026, 22:25 UTC
    Publicly disclosed
  2. 24 Oct 2026, 22:25 UTC
    Reported by oss-security · oss-security
  3. 26 Oct 2026, 16:17 UTC
    NVD reported on it · NVD
  4. 26 Oct 2026, 19:13 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 12:53 UTC
    CERT-Bund (BSI) reported on it · CERT-Bund (BSI)

Sources 4 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-107080 · GHSA-m2h8-hc63-r8ph · ZR-a48b509e
CVSS
6.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
24 Oct 2026, 22:25 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 12:53 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

OpenJPEG image library can crash when encoding images · Zero Radar