Junglewise Threat Intelligence

CVE-2026-6192: uclouvain OpenJPEG integer overflow in opj_pi_initialise_encode

CVE-2026-6192 · Severity: low · CVSS 3.3 · Published 2026-04-13

Executive brief

A vulnerability was found in OpenJPEG, an open-source library used for processing JPEG 2000 images. An attacker could use a specially crafted image file to cause the software to crash or behave unexpectedly. This issue primarily affects the reliability and availability of applications that use this library to encode images.

Technical details

An integer overflow vulnerability exists in the 'opj_pi_initialise_encode' function within 'src/lib/openjp2/pi.c' of OpenJPEG. The 'include_size' variable is calculated using 32-bit multiplications (numlayers * l_step_l) without proper overflow validation. When processing specific encoding parameters, this calculation wraps around, resulting in a smaller-than-required heap buffer allocation via 'opj_calloc'. Subsequent writes to the 'include' array in 'opj_pi_next' functions exceed the buffer bounds, leading to a heap-based buffer overflow. This is a local attack requiring the ability to provide malicious encoding parameters. A patch has been merged into the master branch to implement overflow checks similar to those already present in the decoding path.

Affected products

  • uclouvain OpenJPEG up to 2.5.4

Timeline

  • 2026-04-05: patched: Fix merged into master branch via pull request 1628
  • 2026-04-13: advisory: CVE-2026-6192 published

References