{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-107080", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-10-26T15:32:56.608Z", "dateReserved": "2026-10-07T00:00:00.000Z", "datePublished": "2026-10-26T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-26T15:30:29.976Z"}, "descriptions": [{"lang": "en", "value": "OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/uclouvain/openjpeg/issues/1673"}, {"url": "https://github.com/uclouvain/openjpeg/pull/1674"}, {"url": "https://github.com/uclouvain/openjpeg/commit/a38e970fa59abd796c703ec469e578b09f7ffa33"}, {"url": "https://www.openwall.com/lists/oss-security/2026/10/05/5"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/24/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-26T15:32:56.608Z"}}]}, "dataVersion": "5.2"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service."}], "id": "CVE-2026-107080", "lastModified": "2026-10-26T16:50:49.857", "metrics": {}, "published": "2026-10-26T16:17:10.037", "references": [{"source": "cve@mitre.org", "url": "https://github.com/uclouvain/openjpeg/commit/a38e970fa59abd796c703ec469e578b09f7ffa33"}, {"source": "cve@mitre.org", "url": "https://github.com/uclouvain/openjpeg/issues/1673"}, {"source": "cve@mitre.org", "url": "https://github.com/uclouvain/openjpeg/pull/1674"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/10/05/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/24/8"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "openjpeg2: openjpeg2: Denial of Service via out-of-bounds memory access in opj_dwt_encode_and_deinterleave_v", "id": "2560888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560888"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in OpenJPEG. An out-of-bounds read and write vulnerability exists in the encoder's discrete wavelet transform processing when handling images with specific tile geometries. An attacker who can supply crafted encoding parameters could exploit this flaw to cause heap memory corruption, resulting in an application crash and a Denial of Service (DoS)."], "name": "CVE-2026-107080", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "openjpeg2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "openjpeg2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "openjpeg2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "openjpeg2", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107080\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107080\nhttp://www.openwall.com/lists/oss-security/2026/10/24/8\nhttps://github.com/uclouvain/openjpeg/commit/a38e970fa59abd796c703ec469e578b09f7ffa33\nhttps://github.com/uclouvain/openjpeg/issues/1673\nhttps://github.com/uclouvain/openjpeg/pull/1674\nhttps://www.openwall.com/lists/oss-security/2026/10/05/5"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.4.0,2.5.4]"}}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "openjpeg", "vendor": "uclouvain"}], "created": "2026-10-26T17:45:17.467713+00:00", "updated": "2026-10-27T09:15:18.899330+00:00", "vendors": ["uclouvain", "uclouvain$PRODUCT$openjpeg"]}