Out-of-Bounds Memory Write in OpenJPEG JPEG 2000 Codec by UCLouvain

CVE-2025-54874

What is CVE-2025-54874?

The OpenJPEG library, a widely used open-source JPEG 2000 codec, contains a vulnerability that allows an out-of-bounds heap memory write. This issue arises when the function opj_jp2_read_header is called with a data stream that is shorter than expected while the image data structure is not properly initialized. If exploited, this vulnerability could potentially lead to arbitrary code execution or other unpredictable behaviors, making it essential for users of affected versions to apply the necessary patches and updates.

References