CVE-2026-6192

EUVD-2026-22030
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
uclouvainopenjpeg
2.5.0
CNA
uclouvainopenjpeg
2.5.1
CNA
uclouvainopenjpeg
2.5.2
CNA
uclouvainopenjpeg
2.5.3
CNA
uclouvainopenjpeg
2.5.4
CNA
Debian logo
Debian Releases
Debian Product
Codename
openjpeg2
bookworm
vulnerable
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/uclouvain/openjpeg/
https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951
https://github.com/uclouvain/openjpeg/issues/1619
https://github.com/uclouvain/openjpeg/pull/1628
https://vuldb.com/submit/797385
https://vuldb.com/vuln/357114
https://vuldb.com/vuln/357114/cti