CVE-2026-6192

uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow

State: Published
Severity: 4.8 Medium
Published: Apr 13, 2026
Updated: May 21, 2026
Reserved: Apr 13, 2026

Description

A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-190 Integer Overflow
CWE-189 Numeric Error

Affected Products

Product	Versions
openjpeguclouvain	2.5.0Affected 2.5.1Affected 2.5.2Affected 2.5.3Affected 2.5.4Affected

References

VDB-357114 | uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflowvdb-entrytechnical-description
VDB-357114 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #797385 | uclouvain openjpeg 2.5.4 Integer Overflowthird-party-advisory
https://github.com/uclouvain/openjpeg/issues/1619exploitissue-tracking
https://github.com/uclouvain/openjpeg/pull/1628issue-trackingpatch
https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951patch
https://github.com/uclouvain/openjpeg/product
https://lists.debian.org/debian-lts-announce/2026/05/msg00038.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.