OpenJPH CVE-2026-111151

Exploitation requires the victim application to decode an attacker-supplied JPEG 2000 codestream (.j2c or .jph) using OpenJPH version 0.32.0 or earlier. The crafted file must specify small precinct sizes that create degenerate one-row codeblocks processed by the HTJ2K cleanup-pass decoder - this specific malformed structure is the trigger. Limiting factors: the vector is local (AV:L) and requires user/application interaction to open or process the file (UI:P), so there is no remote unauthenticated path; realistic exposure depends on OpenJPH being embedded in a decode path that accepts untrusted images (upload handlers, viewers, conversion services). No authentication is required (PR:N), but a victim must be induced to process the malicious codestream.

This is a moderate, not top-priority, issue whose signals are internally consistent. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H, score 6.9 Medium) describes a locally-delivered, low-complexity flaw that requires passive user interaction (the victim must decode an attacker-supplied codestream) and whose dominant impact is availability (VA:H, i.e. crashes) with only limited integrity impact (VI:L) and no confidentiality loss (VC:N). This profile matches the description: a heap out-of-bounds WRITE (CWE-787) in the HTJ2K cleanup-pass decoder triggered by degenerate one-row codeblocks. A public PoC (hackmd write-up) exists and the issue was reported by VulnCheck, so publicly available exploit code exists - but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation. No SSVC decision data was supplied. The most important caveat: although this is a memory-corruption WRITE primitive (which can sometimes be escalated to code execution), the official vector caps the integrity impact at Low and emphasizes availability, so the realistic outcome is denial of service / crash rather than confirmed RCE. Note also AV:L - this is not a remote-unauthenticated network flaw; an attacker must get a crafted file to a decoder, so exposure depends heavily on whether a product embeds OpenJPH in an internet-facing decode path.

An attacker crafts a malicious .j2c or .jph JPEG 2000 codestream using small precinct sizes that produce one-row (degenerate) codeblocks, then delivers it to a system or service that decodes images with OpenJPH (e.g. an upload endpoint, viewer, or thumbnailing pipeline). When the victim application decodes it, the HTJ2K cleanup-pass decoder writes a second row past the codeblock buffer, corrupting heap memory and crashing the process. A public proof-of-concept write-up is available, lowering the barrier to reproduction.