CVE-2026-6192

What it actually does

This flaw is an integer overflow in OpenJPEG's JPEG 2000 encoding path, specifically in opj_pi_initialise_encode in src/lib/openjp2/pi.c. A local attacker who can cause an application to encode a crafted image or crafted encoding parameters may trigger incorrect arithmetic during packet iterator initialization, leading to a local availability impact such as process crash, failed image conversion, or service disruption in software that uses OpenJPEG for JPEG 2000 processing. Based on the provided CVSS vector, the expected impact is limited to availability; confidentiality and integrity impact are not indicated.

Why it matters to the business

Organizations using OpenJPEG in desktop tools, media pipelines, document processing systems, image conversion services, digital preservation workflows, or applications that handle JPEG 2000 content may experience crashes or processing failures if a local user or local job submits malicious input. The severity is relatively low because exploitation requires local access or a local execution path and the expected impact is limited to availability, but public exploit availability increases the likelihood of opportunistic testing against exposed workflows.

How an attack unfolds

An attacker first obtains local access to a system or a local execution context where an OpenJPEG-linked application performs JPEG 2000 encoding. They then provide crafted image content or encoding parameters designed to reach opj_pi_initialise_encode. During encoder initialization, vulnerable versions up to 2.5.4 may perform arithmetic that overflows integer bounds. The resulting corrupted size or iterator calculations can cause the application to crash or otherwise fail during processing. In practical terms, exploitation is most likely to appear as a denial-of-service condition against local image-processing workflows rather than remote compromise or data theft.

How to fix it

Apply the upstream OpenJPEG patch identified by commit 839936aa33eb8899bbbd80fda02796bb65068951 or upgrade to a vendor-provided OpenJPEG release that includes this fix. Because no package-specific fixed versions were provided, verify fixed builds through the operating system distribution, application vendor, container image maintainer, or software bill of materials. Rebuild statically linked applications and redeploy containers or bundled software that include vulnerable OpenJPEG code. Where immediate patching is not possible, restrict local access to image conversion tooling, limit who can submit files to JPEG 2000 encoding workflows, sandbox image-processing jobs, impose resource limits, and disable unnecessary JPEG 2000 encoding functionality.

How to confirm the fix worked

Confirm the installed or bundled OpenJPEG version is newer than the vulnerable range or contains upstream commit 839936aa33eb8899bbbd80fda02796bb65068951. Check package manager metadata, application dependency manifests, container SBOMs, and statically linked binaries for libopenjp2/OpenJPEG. Validate that image-processing applications still function after patching and that crafted regression tests no longer crash the encoder. For source builds, inspect src/lib/openjp2/pi.c to ensure the patched integer-bound handling is present in opj_pi_initialise_encode.

Typical attack path

1. Identify a system or application that uses OpenJPEG versions up to 2.5.4 for JPEG 2000 encoding.
2. Gain local access, or access to a local workflow that invokes OpenJPEG-based image encoding.
3. Prepare crafted JPEG 2000-related input or encoding parameters intended to trigger the integer overflow in opj_pi_initialise_encode.
4. Submit the crafted input to the vulnerable encoder or application.
5. Cause the OpenJPEG-linked process to crash, abort, or fail to complete image processing.

How to detect it

Look for evidence of prior exploitation by reviewing application logs, system logs, crash reports, and core dump records for OpenJPEG-linked tools failing during JPEG 2000 encoding. Relevant log sources include Linux syslog or journald, application-specific media-processing logs, container runtime logs, crash dump services such as systemd-coredump or apport, EDR process telemetry, and job scheduler logs for image conversion workers. Investigate repeated segmentation faults, aborts, integer-overflow sanitizer findings, or unexplained failures involving opj_compress, libopenjp2, OpenJPEG, JP2, J2K, or JPEG 2000 encoding tasks. Correlate crashes with recently submitted image files, local user activity, batch jobs, or CI/media-processing tasks. Because this vulnerability is local and availability-focused, exploitation may leave no network indicator; the strongest artifacts are process crashes, malformed input files submitted immediately before the crash, and core dumps referencing opj_pi_initialise_encode or src/lib/openjp2/pi.c.

• opj_pi_initialise_encode
• src/lib/openjp2/pi.c
• libopenjp2
• openjpeg
• opj_compress
• JPEG 2000
• JP2
• J2K
• Segmentation fault.*opj_compress
• segfault.*libopenjp2
• core dumped.*opj_compress
• systemd-coredump.*opj_compress
• AddressSanitizer.*integer overflow
• runtime error: signed integer overflow
• runtime error: unsigned integer overflow

What your security team should do

• Inventory systems, applications, containers, and build pipelines that include OpenJPEG or libopenjp2, especially image conversion and document-processing components.
• Prioritize patching shared servers, multi-user systems, automated media-processing workers, and any workflow where untrusted local users can submit image-processing jobs.
• Apply vendor updates or rebuild from a patched OpenJPEG source tree containing commit 839936aa33eb8899bbbd80fda02796bb65068951.
• Rebuild and redeploy statically linked applications and container images that bundle OpenJPEG rather than relying only on host package updates.
• Add sandboxing, file submission controls, job timeouts, and resource limits around image-processing workloads to reduce denial-of-service impact.
• Monitor for repeated crashes or abnormal failures in OpenJPEG-linked processes, particularly following processing of JPEG 2000 or JP2/J2K inputs.