6 stories, newest first · one card per story
OpenJPEG's heap-buffer-overflow write, fixed on master in February 2026, remains in every release while the project is unmaintained.
OpenJPEG heap-buffer-overflow write fixed on master in February 2026 still ships in releases 2.5.3 and 2.5.4, with no CVE or advisory.
OpenJPEG 2.4.0 through 2.5.4 has an encoder-side heap overflow in its reversible 5/3 wavelet transform.
Foxit PDF Reader JPEG2000 parsing bug CVE-2026-91815 can yield remote code execution after user interaction.
A Ghostscript vulnerability in JPEG 2000 image processing could allow arbitrary code execution via crafted files.
ZDI advisory ZDI-26-666 details an out-of-bounds read (CVE-2026-79910) when Adobe Acrobat Reader DC parses JPEG2000 files.
Today 1.6K readers · 2.5K views · 779 reads · all time 189K views