CVE-2026-107080

What it actually does

Out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() within the discrete wavelet transform code path causes memory corruption that terminates the process.

Why it matters to the business

Image-processing pipelines and applications relying on OpenJPEG can be crashed on demand, interrupting workflows that handle JPEG2000 content and requiring restarts or failover.

How an attack unfolds

An attacker crafts a malformed JPEG2000 image that reaches the vulnerable dwt function during decode or encode; the resulting out-of-bounds access immediately terminates the process with no further attacker control.

How to fix it

Upgrade OpenJPEG to the first release containing the fix for the dwt.c out-of-bounds condition; rebuild and redeploy all dependent applications and containers.

How to confirm the fix worked

Confirm the installed libopenjp2 version is newer than 2.5.4, then re-run regression tests with previously crashing JPEG2000 samples to verify absence of the crash.

Typical attack path

1. Craft a JPEG2000 file that triggers the dwt.c flaw
2. Deliver the file to any application linked against the vulnerable OpenJPEG library
3. Force image processing to invoke opj_dwt_encode_and_deinterleave_v()
4. Trigger out-of-bounds memory access leading to immediate crash

How to detect it

Search application and system logs for segmentation faults or abrupt terminations that coincide with JPEG2000 file handling; correlate with file-upload or image-processing timestamps.

What your security team should do

• Inventory all systems and containers that ship OpenJPEG 2.4.0–2.5.4
• Schedule emergency updates within the next maintenance window given the two-day-old disclosure
• Add JPEG2000 processing crash signatures to application monitoring
• Block untrusted JPEG2000 files at ingress points until patches are applied