Skip to main content

Openjpeg CVE-2026-6192

| EUVDEUVD-2026-22030 LOW
Integer Overflow or Wraparound (CWE-190)
2026-04-13 VulDB GHSA-6jfp-5ggc-pgmx
Buffer Overflow Integer Overflow Openjpeg Uclouvain
1.9
CVSS 4.0 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local system access
  2. Delivery
    Authenticate as unprivileged user
  3. Exploit
    Provide malicious JPEG 2000 file to encoder
  4. Execution
    Trigger opj_pi_initialise_encode with crafted dimensions
  5. Persist
    Integer overflow in buffer calculation
  6. Impact
    Denial of service (memory corruption or crash)

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local system access and authenticated user privileges (PR:L per CVSS vector). The attacker must provide crafted JPEG 2000 input data to an application performing encoding operations via opj_pi_initialise_encode, typically through file I/O or library API calls on the local system. The vulnerability does not require elevated privileges (root/admin) but does necessitate the ability to invoke encoding functions with attacker-controlled dimensions or tile parameters. No remote network access is possible; the attack surface is limited to local code execution contexts.
Impact

The CVSS v4.0 score of 4.8 with AV:L/AC:L/PR:L reflects low attack surface: the vulnerability requires local access (AV:L) and authenticated privileges (PR:L), but once those are met, exploitation is trivial (AC:L). The impact scope is minimal (VA:L only - availability impact, no confidentiality or integrity impact per the vector). Critically, the EPSS score of 0.01% (2nd percentile) indicates this is among the least-exploited vulnerabilities; real-world threat actors prioritize remote, unauthenticated, higher-impact flaws. The presence of publicly available exploit code does not change the low EPSS assessment, suggesting the exploit is either proof-of-concept quality or limited in practical trigger conditions. For most organizations, this is a low-priority patch unless OpenJPEG processes untrusted JPEG 2000 inputs from local authenticated users in a sensitive environment (rare). The gap between CVSS and EPSS is diagnostic of a theoretically exploitable but practically low-risk flaw.
Exploit ScenarioDerived

An authenticated local user on a system with OpenJPEG installed crafts a malicious JPEG 2000 image file with dimensions or tile parameters designed to trigger an integer overflow in opj_pi_initialise_encode. Upon encoding or processing this image through an application linked to the vulnerable library, the overflow causes incorrect buffer allocation or iteration limit calculation, resulting in denial of service (memory exhaustion, crash, or hang). The publicly available proof-of-concept code simplifies this attack by providing tested parameters that reliably trigger the flaw.
Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 15, 2026

Integer overflow in OpenJPEG's opj_pi_initialise_encode function (versions 2.5.0-2.5.4) allows authenticated local attackers to trigger availability impact via crafted input to the pi.c library module. The vulnerability has a publicly available proof-of-concept and carries an EPSS score of 0.01% (2nd percentile), reflecting minimal real-world exploitation likelihood despite the presence of exploit code. Patch commit 839936aa33eb8899bbbd80fda02796bb65068951 is available from the vendor.

RemediationAI

Upgrade OpenJPEG to a patched version; the vendor-released fix corresponds to commit 839936aa33eb8899bbbd80fda02796bb65068951, available via GitHub pull request https://github.com/uclouvain/openjpeg/pull/1628. Users should check the OpenJPEG releases page for the next stable version incorporating this commit (likely 2.5.5 or later, though exact version numbering not confirmed in provided data). In the interim, if immediate patching is not feasible, restrict local access to systems running OpenJPEG and disable JPEG 2000 encoding features if they are not essential. Verify that any downstream applications (document viewers, image editors, codec libraries) using OpenJPEG as a dependency have been updated; refer to the upstream advisory at https://github.com/uclouvain/openjpeg/issues/1619 for detailed technical context.

Affected VersionsENISA

OPENJPEG 2.5.2
OPENJPEG 2.5.4
OPENJPEG 2.5.0
OPENJPEG 2.5.3
OPENJPEG 2.5.1

Affected Packages

euvd openjpeg no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

OpenJPEG is a widely-used JPEG 2000 image codec library implemented in C. The vulnerability exists in the opj_pi_initialise_encode function within src/lib/openjp2/pi.c, which handles packet iterator initialization during the JPEG 2000 encoding process. The root cause is a CWE-190 integer overflow that occurs during arithmetic operations on dimensions or tile parameters, likely when computing buffer sizes or iteration limits. Integer overflows in C image codecs can cascade into heap corruption, out-of-bounds memory access, or allocation failures if the overflowed value is subsequently used in memory operations. The CPE cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:* covers all OpenJPEG products; the affected major versions are 2.5.0 through 2.5.4.

Know when Openjpeg gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
SUSE 1.7 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Red Hat 3.3 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

7
Severity Changed
Apr 29, 2026 - 01:12 NVD
MEDIUM LOW
CVSS changed
Apr 29, 2026 - 01:12 NVD
4.8 (MEDIUM) 1.9 (LOW)
PoC Detected
Apr 29, 2026 - 01:00 vuln.today
Public exploit code
Severity Changed
Apr 13, 2026 - 17:22 NVD
LOW MEDIUM
CVSS changed
Apr 13, 2026 - 17:22 NVD
3.3 (LOW) 4.8 (MEDIUM)
Patch released
Apr 13, 2026 - 17:15 nvd
Patch available
CVE Published
Apr 13, 2026 - 16:45 nvd
LOW 1.9

DescriptionCVE.org

A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Exploit
POC
Public exploit code exists
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity LOW
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
LOW severity (CVSS 0.1-3.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
Poc
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Low
Technical Impact
Partial

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +10
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

More in Openjpeg

View all
CVE-2013-4290 CRITICAL POC
10.0 Apr 18

Stack-based buffer overflow in OpenJPEG before 1.5.2 allows remote attackers to have unspecified impact via unknown vect
CVE-2017-14164 HIGH POC
8.8 Sep 06

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. Rated high severity

CVE-2020-8112 HIGH POC
8.8 Jan 28

opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in th
CVE-2020-6851 HIGH POC
7.5 Jan 13

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack

CVE-2016-7445 HIGH POC
7.5 Oct 03

convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and ap
CVE-2016-7163 HIGH POC
7.8 Sep 21

Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary c
CVE-2016-8332 HIGH POC
7.5 Oct 28

A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. Rated high severity (C
CVE-2012-3535 MEDIUM POC
6.8 Sep 05

Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (applicati
CVE-2016-10504 MEDIUM POC
6.5 Aug 30

Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote
CVE-2016-9112 HIGH POC
7.5 Oct 29

Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.
CVE-2016-9114 HIGH POC
7.5 Oct 30

There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. Rated high severity (CVS
CVE-2016-9113 HIGH POC
7.5 Oct 30

There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. Rated high severity (C

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
PATCH https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951 PATCH https://github.com/uclouvain/openjpeg/pull/1628 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-6192 ADVISORY https://vuldb.com/vuln/357114 REF https://github.com/uclouvain/openjpeg/ REF https://lists.debian.org/debian-lts-announce/2026/05/msg00038.html REF https://vuldb.com/submit/797385 REF https://vuldb.com/vuln/357114 REF https://vuldb.com/vuln/357114/cti

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy