CVE-2026-51807

Katalog CVE

CVSS 9.8 · Critical EPSS 0,67%

Kerentanan Stack-based Buffer Overflow. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validation before coding-pass lengths are written to j2k_codeblock::pass_length[128]. A crafted JPEG 2000 codestream containing malformed PPM packet headers can trigger a heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in source/core/coding/coding_units.cpp due to missing bounds validation for the j2k_codeblock::pass_length[128] array which can lead to heap corruption and process termination.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

17 Juli 2026

Status NVD

Deferred

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/osamu620/OpenHTJ2K/blob/main/CHANGELOG
• https://github.com/osamu620/OpenHTJ2K/commit/0778b93
• https://github.com/osamu620/OpenHTJ2K/compare/0778b93...v0.18.4
• https://github.com/osamu620/OpenHTJ2K/releases