A heap‑based out‑of‑bounds write occurs in OpenHTJ2K’s parse_packet_header function when handling JPEG 2000 codestreams. Malformed PPM packet headers allow an attacker to write length values beyond the bounds of a 128‑element array, corrupting adjacent heap memory and resulting in process termination. The flaw is classified as CWE‑121 and results in service disruption, with no assertion of further exploitation in the supplied description.

The vulnerability affects OpenHTJ2K versions 0.18.3 and earlier. Any application, library, or tool that incorporates these releases and processes external JPEG 2000 content is potentially impacted. Since the project is hosted on GitHub and no commercial vendor is listed, deployments that embed the vulnerable code are at risk.

The CVSS score of 9.8 marks this flaw as Extremely Critical, while the EPSS score of <1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted JPEG 2000 file processed by the vulnerable code, which may be delivered via network or local filesystem. No public exploits are known at this time, but the high severity warrants immediate action.