CVE-2026-107080
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds...
6.5 Medium
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
0.35%Up 0.2 points since Oct 27, 2026
What each source reports
CVE List Score used
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
- Record
CVE-2026-107080- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-109960
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
- Record
EUVD-2026-109960- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m2h8-hc63-r8ph
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds...
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
- Record
GHSA-m2h8-hc63-r8ph- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
- Record
CVE-2026-107080- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
OSV
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
- Record
CVE-2026-107080- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-107080
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
- Record
DEBIAN-CVE-2026-107080- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-107080
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
- Record
UBUNTU-CVE-2026-107080- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjpeg2Debian:12 |
All versions, plus listed versions 2.5.0-22.5.0-2+deb12u12.5.0-2+deb12u22.5.0-2+deb12u32.5.3-1 Show 8 moreShow less2.5.3-1~exp12.5.3-1~exp22.5.3-22.5.3-2.12.5.3-2.1~deb13u12.5.3-2.1~deb13u22.5.4-12.5.4-1.1 |
None known |
openjpeg2Debian:13 |
All versions, plus listed versions 2.5.3-22.5.3-2.12.5.3-2.1~deb13u12.5.3-2.1~deb13u22.5.4-12.5.4-1.1 |
None known |
openjpeg2Debian:14 |
All versions, plus listed versions 2.5.3-22.5.3-2.12.5.3-2.1~deb13u12.5.3-2.1~deb13u22.5.4-12.5.4-1.1 |
None known |
openjpegUbuntu:14.04:LTS |
All versions, plus listed versions 1.3+dfsg-4.6ubuntu21.3+dfsg-4.7ubuntu1 |
None known |
ghostscriptUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 9.16~dfsg~0-0ubuntu39.16~dfsg~0-0ubuntu49.18~dfsg~0-0ubuntu19.18~dfsg~0-0ubuntu29.18~dfsg~0-0ubuntu2.2 Show 33 moreShow less9.18~dfsg~0-0ubuntu2.39.18~dfsg~0-0ubuntu2.49.18~dfsg~0-0ubuntu2.69.18~dfsg~0-0ubuntu2.79.18~dfsg~0-0ubuntu2.89.18~dfsg~0-0ubuntu2.99.25~dfsg+1-0ubuntu0.16.04.19.25~dfsg+1-0ubuntu0.16.04.29.25~dfsg+1-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.19.26~dfsg+0-0ubuntu0.16.04.39.26~dfsg+0-0ubuntu0.16.04.49.26~dfsg+0-0ubuntu0.16.04.59.26~dfsg+0-0ubuntu0.16.04.69.26~dfsg+0-0ubuntu0.16.04.79.26~dfsg+0-0ubuntu0.16.04.89.26~dfsg+0-0ubuntu0.16.04.99.26~dfsg+0-0ubuntu0.16.04.109.26~dfsg+0-0ubuntu0.16.04.119.26~dfsg+0-0ubuntu0.16.04.129.26~dfsg+0-0ubuntu0.16.04.139.26~dfsg+0-0ubuntu0.16.04.149.26~dfsg+0-0ubuntu0.16.04.14+esm19.26~dfsg+0-0ubuntu0.16.04.14+esm29.26~dfsg+0-0ubuntu0.16.04.14+esm39.26~dfsg+0-0ubuntu0.16.04.14+esm49.26~dfsg+0-0ubuntu0.16.04.14+esm59.26~dfsg+0-0ubuntu0.16.04.14+esm69.26~dfsg+0-0ubuntu0.16.04.14+esm79.26~dfsg+0-0ubuntu0.16.04.14+esm89.26~dfsg+0-0ubuntu0.16.04.14+esm99.26~dfsg+0-0ubuntu0.16.04.14+esm109.26~dfsg+0-0ubuntu0.16.04.14+esm11 |
None known |
blenderUbuntu:16.04:LTS |
All versions, plus listed versions 2.74+dfsg0-4build22.75.a+dfsg0-2ubuntu22.75.a+dfsg0-2ubuntu32.76.b+dfsg0-32.76.b+dfsg0-3build1 |
None known |
insighttoolkit4Ubuntu:16.04:LTS |
All versions, plus listed versions 4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1 |
None known |
openjpegUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:1.5.2-3.11:1.5.2-3.1ubuntu0.1~esm2 |
None known |
openjpeg2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.1.0-2.12.1.0-2.1ubuntu0.12.1.2-1.1+deb9u2build0.12.1.2-1.1+deb9u3build0.16.04.12.1.2-1.1+deb9u3ubuntu0.1~esm1 Show 8 moreShow less2.1.2-1.1+deb9u5build0.16.04.12.1.2-1.1+deb9u5ubuntu0.1~esm12.1.2-1.1+deb9u6build0.16.04.12.1.2-1.1+deb9u6ubuntu0.1~esm12.1.2-1.1+deb9u6ubuntu0.1~esm32.1.2-1.1+deb9u6ubuntu0.1~esm42.1.2-1.1+deb9u6ubuntu0.1~esm62.1.2-1.1+deb9u6ubuntu0.1~esm7 |
None known |
texmakerUbuntu:16.04:LTS |
All versions, plus listed versions 4.4.1-14.4.1-1.1 |
None known |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ghostscriptUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 9.21~dfsg+1-0ubuntu39.22~dfsg+1-0ubuntu19.22~dfsg+1-0ubuntu1.19.22~dfsg+1-0ubuntu1.29.25~dfsg+1-0ubuntu0.18.04.1 Show 24 moreShow less9.25~dfsg+1-0ubuntu0.18.04.29.26~dfsg+0-0ubuntu0.18.04.19.26~dfsg+0-0ubuntu0.18.04.39.26~dfsg+0-0ubuntu0.18.04.49.26~dfsg+0-0ubuntu0.18.04.59.26~dfsg+0-0ubuntu0.18.04.69.26~dfsg+0-0ubuntu0.18.04.79.26~dfsg+0-0ubuntu0.18.04.89.26~dfsg+0-0ubuntu0.18.04.99.26~dfsg+0-0ubuntu0.18.04.109.26~dfsg+0-0ubuntu0.18.04.119.26~dfsg+0-0ubuntu0.18.04.129.26~dfsg+0-0ubuntu0.18.04.139.26~dfsg+0-0ubuntu0.18.04.149.26~dfsg+0-0ubuntu0.18.04.159.26~dfsg+0-0ubuntu0.18.04.169.26~dfsg+0-0ubuntu0.18.04.179.26~dfsg+0-0ubuntu0.18.04.189.26~dfsg+0-0ubuntu0.18.04.18+esm19.26~dfsg+0-0ubuntu0.18.04.18+esm29.26~dfsg+0-0ubuntu0.18.04.18+esm39.26~dfsg+0-0ubuntu0.18.04.18+esm49.26~dfsg+0-0ubuntu0.18.04.18+esm59.26~dfsg+0-0ubuntu0.18.04.18+esm6 |
None known |
blenderUbuntu:18.04:LTS |
All versions, plus listed versions 2.78.c+dfsg0-2build12.79+dfsg0-2build12.79+dfsg0-32.79+dfsg0-3build12.79.b+dfsg0-12.79.b+dfsg0-1ubuntu1.18.04.1 |
None known |
insighttoolkit4Ubuntu:18.04:LTS |
All versions, plus listed versions 4.12.2-dfsg1-1ubuntu1 |
None known |
openjpeg2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.2.0-12.3.0-12.3.0-2build0.18.04.12.3.0-2ubuntu0.1~esm12.3.0-2+deb10u2build0.18.04.1 Show 5 moreShow less2.3.0-2+deb10u2ubuntu0.1~esm12.3.0-2+deb10u2ubuntu0.1~esm22.3.0-2+deb10u2ubuntu0.1~esm32.3.0-2+deb10u2ubuntu0.1~esm42.3.0-2+deb10u2ubuntu0.1~esm5 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-45.9.1+dfsg-4ubuntu15.9.2+dfsg-2ubuntu15.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2+esm1 |
None known |
texmakerUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.5-15.0.2-15.0.2-1build15.0.2-1build25.0.2-1ubuntu0.1~esm1 |
None known |
openjpeg2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.3.0-22.3.0-2build12.3.1-12.3.1-1ubuntu32.3.1-1ubuntu4 Show 5 moreShow less2.3.1-1ubuntu4.20.04.12.3.1-1ubuntu4.20.04.22.3.1-1ubuntu4.20.04.32.3.1-1ubuntu4.20.04.42.3.1-1ubuntu4.20.04.4+esm1 |
None known |
blenderUbuntu:20.04:LTS |
All versions, plus listed versions 2.80+dfsg-32.80+dfsg-3build12.80+dfsg-42.81.a+dfsg-5build32.82+dfsg-12.82+dfsg-1build12.82.a+dfsg-1 |
None known |
insighttoolkit4Ubuntu:20.04:LTS |
All versions, plus listed versions 4.12.2-dfsg1-4.1ubuntu14.13.2-dfsg1-1ubuntu14.13.2-dfsg1-4ubuntu14.13.2-dfsg1-64.13.2-dfsg1-6ubuntu14.13.2-dfsg1-8 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.12.4+dfsg-1ubuntu15.12.4+dfsg-1ubuntu35.12.5+dfsg-3ubuntu15.12.5+dfsg-6ubuntu25.12.5+dfsg-7 Show 4 moreShow less5.12.5+dfsg-7build15.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu1.15.12.8+dfsg-0ubuntu1.1+esm1 |
None known |
texmakerUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.0.3-1build25.0.3-1build35.0.3-1build45.0.3-1build55.0.3-1ubuntu0.20.04.1~esm1 |
None known |
blenderUbuntu:22.04:LTS |
All versions, plus listed versions 2.93.3+dfsg-32.93.5+dfsg-12.93.5+dfsg-1build13.0.1+dfsg-7 |
None known |
insighttoolkit4Ubuntu:22.04:LTS |
All versions, plus listed versions 4.13.3withdata-dfsg1-4.14.13.3withdata-dfsg2-1ubuntu1 |
None known |
openjpeg2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.3.1-1ubuntu52.3.1-1ubuntu62.4.0-32.4.0-52.4.0-6 Show 5 moreShow less2.4.0-6ubuntu0.12.4.0-6ubuntu0.22.4.0-6ubuntu0.32.4.0-6ubuntu0.42.4.0-6ubuntu0.5 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.15.6+dfsg-15.15.6+dfsg-25.15.7+dfsg-25.15.8+dfsg-15.15.8+dfsg-1build1 Show 4 moreShow less5.15.8+dfsg-1build25.15.8+dfsg-25.15.9+dfsg-15.15.9+dfsg-1ubuntu0.1~esm1 |
None known |
texmakerUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.0.3-1build85.0.3-1build95.0.3-1ubuntu0.22.04.1~esm1 |
None known |
blenderUbuntu:24.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-2ubuntu13.6.2+dfsg-2ubuntu24.0.2+dfsg-1ubuntu14.0.2+dfsg-1ubuntu24.0.2+dfsg-1ubuntu44.0.2+dfsg-1ubuntu64.0.2+dfsg-1ubuntu74.0.2+dfsg-1ubuntu8 |
None known |
openjpeg2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.5.0-22.5.0-2build22.5.0-2build32.5.0-2ubuntu0.12.5.0-2ubuntu0.22.5.0-2ubuntu0.32.5.0-2ubuntu0.42.5.0-2ubuntu0.5 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.15.15+dfsg-25.15.15+dfsg-2build25.15.15+dfsg-2ubuntu15.15.16+dfsg-15.15.16+dfsg-1ubuntu25.15.16+dfsg-1ubuntu45.15.16+dfsg-35.15.16+dfsg-3ubuntu0.1~esm1 |
None known |
texmakerUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.1.3+dfsg-1build45.1.3+dfsg-1build55.1.3+dfsg-1build65.1.3+dfsg-1build75.1.3+dfsg-1build85.1.3+dfsg-1ubuntu0.1~esm1 |
None known |
blenderUbuntu:26.10 |
All versions, plus listed versions 5.0.1+dfsg-1ubuntu15.0.1+dfsg-1ubuntu35.0.1+dfsg-3build15.0.1+dfsg-5 |
None known |
openjpeg2Ubuntu:26.10 |
All versions, plus listed versions 2.5.4-12.5.4-1ubuntu0.12.5.4-1.1 |
None known |
qtwebengine-opensource-srcUbuntu:26.10 |
All versions, plus listed versions 5.15.19+dfsg2-45.15.19+dfsg2-65.15.19+dfsg2-7 |
None known |
texmakerUbuntu:26.10 |
All versions, plus listed versions 6.0.1+dfsg-3build16.0.1+dfsg-3build2 |
None known |
blenderUbuntu:26.04:LTS |
All versions, plus listed versions 4.3.2+dfsg-2ubuntu25.0.1+dfsg-1ubuntu1 |
None known |
openjpeg2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.5.3-2.12.5.4-12.5.4-1ubuntu0.1 |
None known |
texmakerUbuntu:26.04:LTS |
All versions, plus listed versions 5.1.3+dfsg-3build16.0.1+dfsg-36.0.1+dfsg-3build1 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 5.15.19+dfsg2-15.15.19+dfsg2-1build15.15.19+dfsg2-25.15.19+dfsg2-35.15.19+dfsg2-45.15.19+dfsg2-4ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-107080 is a medium vulnerability (CVSS 6.5) in openjpeg, published October 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. No source names a fixed version.
References
github.com/uclouvain/openjpeg/issues/1673
openwall.com/lists/oss-security/2026/10/05/5
nvd.nist.gov/vuln/detail/CVE-2026-107080
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2026-107080
ubuntu.com/security/CVE-2026-107080
cve.org/CVERecord?id=CVE-2026-107080
advisory.echohq.com/cve/cve-2026-107080