The vulnerability resides in the OpenJPEG 2.4.0 through 2.5.4 releases and in the git master branch up to commit 8314119b. It involves an out-of-bounds read and write inside the opj_dwt_encode_and_deinterleave_v() function in src/lib/openjp2/dwt.c. These memory violations can cause the library to crash, resulting in a denial of service of the hosting application. The only confirmed impact is loss of availability; no data corruption or confidentiality compromise is disclosed.

The software affected is the OpenJPEG image decoding library, versions 2.4.0 through 2.5.4 and any build that has not applied the patch in commit 8314119b. This library is typically used by applications that process JPEG images, so any system that incorporates these OpenJPEG releases could be impacted if it processes untrusted or maliciously crafted JPEG files.

The CVSS score is not listed and no EPSS score is available, so formal quantitative risk metrics cannot be calculated. Nevertheless, the vulnerability is considered moderate to high because the out-of-bounds operations lead to a clear denial of service effect without any authentication requirements. The likely attack vector is the injection of a specially crafted JPEG image into an application that uses the vulnerable OpenJPEG library. This vector is inferred because the bug resides in the image decoding routine, which is invoked when processing external JPEG data. The lack of a CISA KEV listing does not diminish the technical seriousness; organizations should treat the issue as a potential local or remote DoS risk depending on how the vulnerable library is exposed.