PatchFirst · Latest vulnerabilities

openjpeg vulnerabilities

Vulnerabilities published for openjpeg in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 30

CVE-2026-6192
Medium · CVSS 4.8EPSS 0.11%No fix published
uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.
openjpeg Operating systems
Published April 13, 2026Updated May 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2025-50952
Medium · CVSS 6.5EPSS 0.27%No fix published
CVE-2025-50952
openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.
openjpeg Operating systems
Published August 7, 2025Updated December 29, 2025
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2023-39329
Medium · CVSS 6.5EPSS 0.59%No fix published
Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c
A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.
openjpeg Operating systems
Published July 13, 2024Updated September 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2023-39327
Medium · CVSS 4.3EPSS 0.56%No fix published
Openjpeg: malicious files can cause the program to enter a large loop
A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
openjpeg Operating systems
Published July 13, 2024Updated September 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2023-39328
Medium · CVSS 5.5EPSS 0.24%No fix published
Openjpeg: denail of service via crafted image file
A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.
openjpeg Operating systems
Published July 9, 2024Updated June 26, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2020-27824
Medium · CVSS 5.5EPSS 1.61%No fix published
CVE-2020-27824
A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability.
openjpeg Operating systems
Published May 13, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2020-27845
Medium · CVSS 5.5EPSS 1.52%No fix published
CVE-2020-27845
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.
openjpeg Operating systems
Published January 5, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2020-27843
Medium · CVSS 5.5EPSS 1.77%No fix published
CVE-2020-27843
A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.
openjpeg Operating systems
Published January 5, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2020-27842
Medium · CVSS 5.5EPSS 1.52%No fix published
CVE-2020-27842
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
openjpeg Operating systems
Published January 5, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2018-21010
High · CVSS 8.8EPSS 2.09%No fix published
CVE-2018-21010
OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
openjpeg Operating systems
Published September 5, 2019Updated August 5, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2018-20846
Medium · CVSS 6.5EPSS 2.17%No fix published
CVE-2018-20846
Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
openjpeg Operating systems
Published June 26, 2019Updated August 5, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2018-18088
Medium · CVSS 6.5EPSS 1.96%No fix published
CVE-2018-18088
OpenJPEG 2.3.0 has a NULL pointer dereference for "red" in the imagetopnm function of jp2/convert.c
openjpeg Operating systems
Published October 9, 2018Updated August 5, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2018-16376
High · CVSS 8.8EPSS 2.84%No fix published
CVE-2018-16376
An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
openjpeg Operating systems
Published September 3, 2018Updated August 5, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2016-9580
Low · CVSS 3.3EPSS 1.99%No fix published
CVE-2016-9580
An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.
openjpeg Operating systems
Published August 1, 2018Updated August 6, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2016-9572
Medium · CVSS 5.9EPSS 2.17%No fix published
CVE-2016-9572
A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image.
openjpeg Operating systems
Published August 1, 2018Updated August 6, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2016-9581
Low · CVSS 3.3EPSS 1.94%No fix published
CVE-2016-9581
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.
openjpeg Operating systems
Published August 1, 2018Updated August 6, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2016-9573
Medium · CVSS 6.5EPSS 2.47%No fix published
CVE-2016-9573
An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap.
openjpeg Operating systems
Published August 1, 2018Updated August 6, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2018-5727
Medium · CVSS 6.5EPSS 1.82%No fix published
CVE-2018-5727
In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
openjpeg Operating systems
Published January 16, 2018Updated August 5, 2024
Source advisory 1 ↗Source advisory 2 ↗
CVE-2017-17479
Critical · CVSS 9.8EPSS 4.04%No fix published
CVE-2017-17479
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
openjpeg Operating systems
Published December 8, 2017Updated August 5, 2024
Source advisory 1 ↗Source advisory 2 ↗
CVE-2016-10506
Medium · CVSS 6.5EPSS 3.32%No fix published
CVE-2016-10506
Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
openjpeg Operating systems
Published August 30, 2017Updated August 6, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

openjpeg vulnerabilities

uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow

CVE-2025-50952

Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c

Openjpeg: malicious files can cause the program to enter a large loop

Openjpeg: denail of service via crafted image file

CVE-2020-27824

CVE-2020-27845

CVE-2020-27843

CVE-2020-27842

CVE-2018-21010

CVE-2018-20846

CVE-2018-18088

CVE-2018-16376

CVE-2016-9580

CVE-2016-9572

CVE-2016-9581

CVE-2016-9573

CVE-2018-5727

CVE-2017-17479

CVE-2016-10506

Check your server