A buffer overflow exists in the OpenHTJ2K image decoder library (versions 0.18.4 and earlier) in several decoder entry points. The overflow occurs when the decoder processes certain JPEG 2000 data streams, allowing an attacker to supply crafted input that overwrites stack data and potentially redirects execution. This flaw is a classic buffer overflow and can lead to arbitrary code execution on the host where the decoder runs.

The affected product is the OpenHTJ2K library, v0.18.4 and earlier. Any application that embeds this library and processes untrusted JPEG 2000 files could be exposed. No specific provided, but any software using OpenHTJ2K in this version range is at risk.

The CVSS score of 9.8 places this vulnerability in the critical range, but the EPSS score of less than 1 % indicates a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a crafted JPEG 2000 stream that an application accepts from a remote or otherwise uncontrolled source; this inference is derived from the fact that the overflow occurs when the decoder processes image data.