EUVD-2026-44581
GHSA-rqpx-m8w5-7hj9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
JPIP server path is network-reachable with no auth or user interaction (AV:N/PR:N/UI:N/AC:L); confirmed heap info leak gives C:H and OOB heap write supports I:H/A:H, matching the published base score.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded function in source/core/interface/decoder.cpp
AnalysisAI
Heap out-of-bounds read/write in OpenHTJ2K (High-Throughput JPEG 2000 reference codec) v0.18.4 and earlier lets an attacker corrupt heap memory by supplying a crafted J2K/JP2 codestream, with a confirmed heap information-leak primitive and vendor-claimed arbitrary code execution. The flaw is reached through every decoder entry point (invoke, invoke_line_based, invoke_line_based_stream, invoke_line_based_predecoded) and, notably, through a JPIP server's startup codestream load, making it network-reachable without user interaction. There is no public exploit identified at time of analysis, though the vendor changelog references non-public PoC files, and the issue is not listed in CISA KEV.
Technical ContextAI
OpenHTJ2K is an open-source reference implementation of the High-Throughput JPEG 2000 (HTJ2K, ITU-T T.814 / JPEG 2000 Part 15) image codec. The root cause is an unchecked SOT (Start-of-Tile) marker field: the Isot tile index parsed from the codestream is used to dispatch tile-parts via j2k_tile::add_tile_part() without validating it against the number of tiles (numTiles.x * numTiles.y, i.e. tileSet.size()). Although MITRE classifies this as CWE-120 (classic buffer overflow), the mechanism is more precisely improper validation of an array index (CWE-129) leading to heap out-of-bounds read/write; the vendor confirms heap pointers written by add_tile_part() into memory adjacent to the tileSet allocation can be reflected back to a client through later JPIP tile-header data-bin responses. AddressSanitizer originally flagged the heap-buffer-overflow at coding_units.cpp:3336, fixed at all four SOT-dispatch sites in source/core/interface/decoder.cpp.
RemediationAI
Vendor-released patch: v0.18.5 - upgrade to OpenHTJ2K v0.18.5 or later (release https://github.com/osamu620/OpenHTJ2K/releases/tag/v0.18.5, fix in PR https://github.com/osamu620/OpenHTJ2K/pull/320), which adds a bounds check rejecting SOT tile indices where Isot >= numTiles and throws before any write through the offending pointer. If you cannot upgrade immediately, do not decode untrusted or externally sourced JPEG 2000 (J2K/JP2) content, and for JPIP deployments restrict or disable network exposure of the JPIP server and avoid loading untrusted startup codestreams; note these controls reduce functionality (blocking legitimate remote J2K workflows). Rebuilding/testing under AddressSanitizer is recommended to confirm the fix, since the vendor verified the previously reported heap-buffer-overflow at coding_units.cpp:3336 no longer triggers for the published PoCs.
Same weakness CWE-120 – Classic Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today