CVE-2026-107080

EUVD-2026-109960
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 8%
Debian logo
Debian Releases
Debian Product
Codename
openjpeg2
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Vulnerability Media Exposure
References
https://github.com/uclouvain/openjpeg/commit/a38e970fa59abd796c703ec469e578b09f7ffa33
https://github.com/uclouvain/openjpeg/issues/1673
https://github.com/uclouvain/openjpeg/pull/1674
https://www.openwall.com/lists/oss-security/2026/10/05/5
http://www.openwall.com/lists/oss-security/2026/10/24/8