Description
OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes.
Published: 2026-10-15
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Corruption / Crash
Action: Apply Patch
AI Analysis

Impact

OpenJPH up through version 0.32.0 contains a heap out-of-bounds write in the HTJ2K cleanup-pass decoder. The flaw is triggered when the decoder attempts to write a second row past the end of a code-block buffer after processing a specially crafted .j2c or .jph codestream with extremely small precinct sizes. This write corrupts adjacent memory, causing application crashes. The weakness is a classic out-of-bounds write (CWE-787).

Affected Systems

Vendor aous72’s OpenJPH component, versions up to and including 0.32.0. These releases are affected; newer releases are not listed as vulnerable.

Risk and Exploitability

CVSS score 6.9 indicates moderate severity. EPSS <1% reflects a very low exploitation probability at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need to supply a specially crafted .j2c or .jph codestream, implying a local or file upload context. While no public evidence of exploitation exists, the potential for memory corruption and crash means that environments processing untrusted image streams should be considered at elevated risk until a patched release is deployed.

Generated by OpenCVE AI on October 16, 2026 at 18:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest OpenJPH release that contains the fix for the heap out-of-bounds write.
  • Reject or sanitize any .j2c or .jph codestreams with unusually small precinct sizes before decoding, or validate them in a trusted environment.
  • Run OpenJPH in a sandboxed or containerized environment to contain crashes or potential exploitation.

Generated by OpenCVE AI on October 16, 2026 at 18:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Aous72
Aous72 openjph
Vendors & Products Aous72
Aous72 openjph

Thu, 15 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes.
Title OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Aous72 Openjph
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T19:36:21.172Z

Reserved: 2026-10-15T17:04:00.239Z

Link: CVE-2026-111151

cve-icon Vulnrichment

Updated: 2026-10-15T19:36:15.941Z

cve-icon NVD

Status : Deferred

Published: 2026-10-15T19:17:29.800

Modified: 2026-10-16T18:25:45.343

Link: CVE-2026-111151

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:56:11Z

Weaknesses