A flaw was discovered in the OpenJPEG library in the function that initializes the compression pipeline. A crafted input can trigger an integer overflow during the encoding process, potentially corrupting memory or causing a crash. The weakness corresponds to improper handling of size values, a classic integer overflow scenario. While the description does not explicitly state a code execution vector, such overflow could lead to arbitrary code execution if the attacker can manipulate the data fed to the library.

The vulnerability affects the OpenJPEG library from the University of Lille (uClouvain) through version 2.5.4. The issue resides in the source file src/lib/openjp2/pi.c and is mitigated in later releases.

The CVSS score for this flaw is 4.8, indicating low to medium severity. No EPSS data is available, and the vulnerability is not listed as a known exploited vulnerability by CISA. Attackers must have local access to supply the crafted data; remote exploitation is unlikely. However, the publicly available exploit code suggests that once a user runs OpenJPEG on untrusted data locally, the integer overflow could be triggered.