| Name | CVE-2026-107080 |
| Description | OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| openjpeg2 (PTS) | bookworm, bookworm (security) | 2.5.0-2+deb12u3 | vulnerable |
| trixie (security), trixie | 2.5.3-2.1~deb13u2 | vulnerable | |
| forky, sid | 2.5.4-1.1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| openjpeg2 | source | (unstable) | (unfixed) |
https://github.com/uclouvain/openjpeg/issues/1673
https://github.com/uclouvain/openjpeg/pull/1674
Introduced with: https://github.com/uclouvain/openjpeg/commit/a38e970fa59abd796c703ec469e578b09f7ffa33 (v2.4.0)
https://www.openwall.com/lists/oss-security/2026/10/05/5