OpenJPEG 2.4.0 through 2.5.4 assigned CVE-2026-107080 for heap overflow
Original title: Re: openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder)
MITRE describes an out-of-bounds read and write that can cause denial of service; the proposed fix is still unmerged.
CVE-2026-107080 covers a heap buffer overflow in OpenJPEG's reversible 5/3 forward DWT encoder. The bug is an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c, affecting 2.4.0 through 2.5.4 and git master through commit 8314119b. MITRE limits the stated impact to denial of service. Red Eagle Tech says nothing else changed since the October 5 report and the upstream fix has not been merged.
Unconfirmed: The reporter says the proposed upstream fix has not been merged.
- The CVE assignment note was posted on October 24.
- The issue was first reported on October 5, 2026.
- Git master through commit 8314119b is also affected.
- The vulnerable function lives in src/lib/openjp2/dwt.c.
Impact: denial of service via out-of-bounds read and write
| Product | Affected |
|---|---|
| OpenJPEG | 2.4.0 through 2.5.4 and git master through commit 8314119b |
- 1.Treat OpenJPEG 2.4.0 through 2.5.4 and current git master as unfixed.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107080 | — | — | — |
From the original article
Posted by Security @ Red Eagle Tech on Oct 24 Hello, CVE-2026-107080 has been assigned to the issue reported here on 5 October 2026. MITRE's description: OpenJPEG 2. 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.