CVE-2026-107080

A flaw was found in OpenJPEG. An out-of-bounds read and write vulnerability exists in the encoder's discrete wavelet transform processing when handling images with specific tile geometries. An attacker who can supply crafted encoding parameters could exploit this flaw to cause heap memory corruption, resulting in an application crash and a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because successful exploitation requires passing specific tile dimensions and decomposition levels to the image compression routines, resulting exclusively in application crashes rather than arbitrary code execution or data leakage. In typical Red Hat Enterprise Linux deployments, the library is predominantly utilized for decoding JPEG 2000 files rather than generating them, significantly reducing the exposure surface. Furthermore, the issue only affects encoder workflows utilizing reversible compression parameters, meaning general file processing remains unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.