CVE-2026-51807
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A heap-based out-of-bounds write vulnerability exists in OpenHTJ2K versions 0.18.3 and earlier. The issue occurs in j2k_precinct_subband::parse_packet_header() due to missing bounds validation before writing coding-pass lengths to the j2k_codeblock::pass_length[128] array.
Risk Assessment
An attacker can exploit a crafted JPEG 2000 codestream with malformed PPM packet headers to cause heap corruption and process termination, potentially disrupting applications using the library.
Recommendation
Upgrade OpenHTJ2K to version 0.18.4 or later immediately, which includes a fix for this vulnerability.
Original NVD description (English source)
Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validation before coding-pass lengths are written to j2k_codeblock::pass_length[128]. A crafted JPEG 2000 codestream containing malformed PPM packet headers can trigger a heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in source/core/coding/coding_units.cpp due to missing bounds validation for the j2k_codeblock::pass_length[128] array which can lead to heap corruption and process termination.