Description
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| uclouvain | openjpeg | 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openjpeg2 | 2.5.4-1.1 | — |
| Debian 13 | openjpeg2 | 2.5.3-2.1~deb13u2 | — |
| Debian 12 | openjpeg2 | 2.5.0-2+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | blender +2 | No fix yet | — |
| Ubuntu 26.04 LTS | blender +1 | No fix yet | — |
| Ubuntu 26.04 LTS | openjpeg2 | 2.5.4-1ubuntu0.1 | — |
| Ubuntu 25.10 | blender +2 | No fix yet | — |
| Ubuntu 25.10 | openjpeg2 | 2.5.3-2.1ubuntu0.1 | — |
| Ubuntu 24.04 LTS | blender | No fix yet | — |
| Ubuntu 24.04 LTS | openjpeg2 | 2.5.0-2ubuntu0.5 | — |
| Ubuntu 22.04 LTS | blender +1 | No fix yet | — |
| Ubuntu 22.04 LTS | openjpeg2 | 2.4.0-6ubuntu0.5 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | blender +1 | No fix yet | — |
| Ubuntu 18.04 LTS | blender +1 | No fix yet | — |
| Ubuntu 16.04 LTS | blender +2 | No fix yet | — |
| Ubuntu 14.04 LTS | openjpeg | No fix yet | — |
| Ubuntu Pro 26.04 LTS | qtwebengine-opensource-src | No fix yet | — |
| Ubuntu Pro 24.04 LTS | texmaker +1 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | texmaker +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | texmaker +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | texmaker +3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | openjpeg +2 | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openjpeg | 2.5.4-r2 | — |
| Alpine v3.24 | qt6-qtwebengine | 6.11.0-r9 | — |
| Alpine v3.23 | openjpeg | 2.5.4-r2 | — |
| Alpine v3.23 | qt6-qtwebengine | 6.10.3-r3 | — |
| Alpine v3.22 | openjpeg | 2.5.4-r1 | — |
| Alpine v3.21 | openjpeg | 2.5.4-r1 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | openjpeg2 | No fix yet | — |
Advisories 1
- WID-SEC-2026-1080 OpenJPEG: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · May 21, 2026
References
- VDB-357114 | uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow vdb-entry technical-description
- VDB-357114 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #797385 | uclouvain openjpeg 2.5.4 Integer Overflow third-party-advisory
- https://github.com/uclouvain/openjpeg/issues/1619 exploit issue-tracking
- https://github.com/uclouvain/openjpeg/pull/1628 issue-tracking patch
- https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951 patch
- https://github.com/uclouvain/openjpeg/ product