Re: OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4)
OpenJPEG's heap-buffer-overflow write, fixed on master in February 2026, remains in every release while the project is unmaintained.
An oss-security follow-up says a heap-buffer-overflow write in OpenJPEG was fixed on master in February 2026 but remains in every release, including 2.5.3 and 2.5.4. Stuart Henderson noted the uclouvain/openjpeg repository should be considered unmaintained, with no committer regularly reviewing tickets or pull requests. The post does not cite a CVE or confirmed exploitation.
- Heap-buffer-overflow write was fixed on master in February 2026.
- The bug remains in every release, including 2.5.3 and 2.5.4.
- Maintainers say nobody regularly reviews issues or pull requests.
- The post names no CVE and no observed exploitation.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 06bbae8b5d5e57f8c28fe862b80a9464b320e314 | unmaintained: https://github.com/uclouvain/openjpeg/commit/06bbae8b5d5e57f8c28fe862b80a9464b320e314 "This repository should be considered unmaintained. Commits |
From the original article
Posted by Stuart Henderson on Oct 09 It is unmaintained: https://github. com/uclouvain/openjpeg/commit/06bbae8b5d5e57f8c28fe862b80a9464b320e314 "This repository should be considered unmaintained. Commits may appear from time to time depending on committer interest and mood, but no committer currently feel responsible to regularly review tickets or pull requests."
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.