Executive brief
OpenHTJ2K is an open-source library used for decoding JPEG 2000 images, often utilized in high-performance imaging and JPIP servers. A security flaw allows a specially crafted image file to trigger a memory error, potentially allowing an attacker to steal sensitive information from the server's memory or cause the application to crash. This could lead to the exposure of private data or a disruption of services that process these image files.
Technical details
A heap buffer overflow exists in OpenHTJ2K versions 0.18.4 and earlier due to a lack of validation for the SOT (Start of Tile-part) marker's tile index (Isot). When a crafted J2K/JP2 file provides an Isot value greater than or equal to the number of tiles, the decoder performs out-of-bounds reads and writes in the 'j2k_tile::add_tile_part' function. This is reachable via multiple public decoder entry points, including 'invoke', 'invoke_line_based', and 'invoke_line_based_stream'. In a JPIP server context, this primitive can be used to leak heap pointer values back to a client through subsequent tile-header data-bin responses. The vulnerability is fixed in version 0.18.5 by adding explicit tile index range validation.
Affected products
- osamu620 OpenHTJ2K <= 0.18.4
Timeline
- 2026-04-28: patched: Version 0.18.5 released to address the heap OOB issue.
- 2026-07-14: advisory: CVE-2026-51808 published by NVD.