Openjpeg
85 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Openjpeg, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Openjpeg CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 2 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 2 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 1 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 85 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical9
- High27
- Medium46
- Low3
Latest CVEs
The 15 most recently published vulnerabilities affecting Openjpeg.
- CVE-2026-6192uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow3.3
- CVE-2025-50952openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.6.5
- CVE-2025-54874OpenJPEG allows OOB heap memory write in opj_jp2_read_header9.8
- CVE-2024-56827Openjpeg: heap buffer overflow in lib/openjp2/j2k.c5.6
- CVE-2024-56826Openjpeg: heap buffer overflow in bin/common/color.c5.6
- CVE-2023-39329Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c6.5
- CVE-2023-39327Openjpeg: malicious files can cause the program to enter a large loop4.3
- CVE-2023-39328Openjpeg: denail of service via crafted image file5.5
- CVE-2022-1122A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames o...5.5
- CVE-2021-3575A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissi...7.8
- CVE-2020-27823A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is t...7.8
- CVE-2020-27824A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overf...5.5
- CVE-2021-29338Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a di...5.5
- CVE-2020-27814A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with th...7.8
- CVE-2020-27845There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an...5.5
Product grouping is registry-driven, with AI assist and human review. How it works