CVE-2026-6192

EUVD-2026-22030
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulDBCNA
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 1.52%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
uclouvainopenjpeg
2.5.0
CNA
uclouvainopenjpeg
2.5.1
CNA
uclouvainopenjpeg
2.5.2
CNA
uclouvainopenjpeg
2.5.3
CNA
uclouvainopenjpeg
2.5.4
CNA
Debian logo
Debian Releases
Debian Product
Codename
openjpeg2
bookworm
2.5.0-2+deb12u3
fixed
bookworm (security)
2.5.0-2+deb12u3
fixed
bullseye
vulnerable
bullseye (security)
2.4.0-3+deb11u3
fixed
forky
2.5.4-1.1
fixed
sid
2.5.4-1.1
fixed
trixie
2.5.3-2.1~deb13u2
fixed
trixie (security)
2.5.3-2.1~deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qtwebengine-opensource-src
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
blender
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
ignored
texmaker
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
ignored
ghostscript
bionic
needs-triage
focal
not-affected
jammy
not-affected
noble
not-affected
questing
not-affected
resolute
not-affected
xenial
needs-triage
insighttoolkit4
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
questing
dne
resolute
dne
xenial
ignored
openjpeg
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
needs-triage
xenial
ignored
openjpeg2
bionic
needs-triage
focal
needs-triage
jammy
Fixed 2.4.0-6ubuntu0.5
released
noble
Fixed 2.5.0-2ubuntu0.5
released
questing
Fixed 2.5.3-2.1ubuntu0.1
released
resolute
Fixed 2.5.4-1ubuntu0.1
released
xenial
ignored
Common Weakness Enumeration
References
https://github.com/uclouvain/openjpeg/
https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951
https://github.com/uclouvain/openjpeg/issues/1619
https://github.com/uclouvain/openjpeg/pull/1628
https://vuldb.com/submit/797385
https://vuldb.com/vuln/357114
https://vuldb.com/vuln/357114/cti
https://lists.debian.org/debian-lts-announce/2026/05/msg00038.html