CVE-2026-51808
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A buffer overflow vulnerability has been discovered in the OpenHTJ2K library version 0.18.4 and earlier. An attacker can exploit this flaw in the invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded functions in decoder.cpp, allowing arbitrary code execution.
Risk Assessment
The risk to the organization is the potential for remote arbitrary code execution by an attacker, which could lead to system compromise, data theft, or service disruption.
Recommendation
It is recommended to immediately update the OpenHTJ2K library to a version later than 0.18.4 that includes a fix for this vulnerability. Also review and update all applications using this library.
Original NVD description (English source)
Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded function in source/core/interface/decoder.cpp