Log in Start free

Vulnerability · Published Aug 5, 2025 · Assigned by GitHub_M

CVE-2025-54874OpenJPEG allows OOB heap memory write in opj_jp2_read_header

Medium 6.6

In plain English

A medium-severity security flaw in openjpeg from uclouvain. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.6Medium
Exploit odds (30 days)0.7%top 48.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10openjpeg22.5.2-4.el10_0.1ALSA-2025:13944
AlmaLinux:10openjpeg2-devel2.5.2-4.el10_0.1ALSA-2025:13944
AlmaLinux:10openjpeg2-tools2.5.2-4.el10_0.1ALSA-2025:13944
Alpine:v3.21openjpeg2.5.4-r0ALPINE-CVE-2025-54874
Alpine:v3.22openjpeg2.5.4-r0ALPINE-CVE-2025-54874
Alpine:v3.23openjpeg2.5.3-r1ALPINE-CVE-2025-54874
Alpine:v3.24openjpeg2.5.3-r1ALPINE-CVE-2025-54874
Alpine:v3.23qt6-qtwebengine6.9.2-r1ALPINE-CVE-2025-54874
Alpine:v3.24qt6-qtwebengine6.9.2-r1ALPINE-CVE-2025-54874
Debian:13openjpeg22.5.3-2.1~deb13u1DEBIAN-CVE-2025-54874
Debian:14openjpeg22.5.3-2.1DEBIAN-CVE-2025-54874
Rocky Linux:10openjpeg20:2.5.2-4.el10_0.1RLSA-2025:13944
Ubuntu:22.04:LTSblenderno fix listedUBUNTU-CVE-2025-54874
Ubuntu:24.04:LTSblenderno fix listedUBUNTU-CVE-2025-54874
Ubuntu:25.10blenderno fix listedUBUNTU-CVE-2025-54874
Ubuntu:26.04:LTSblenderno fix listedUBUNTU-CVE-2025-54874
Ubuntu:26.10blenderno fix listedUBUNTU-CVE-2025-54874
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2025-54874
Ubuntu:22.04:LTSopenjpeg22.4.0-6ubuntu0.4USN-7757-1
Ubuntu:24.04:LTSopenjpeg22.5.0-2ubuntu0.4USN-7757-1
Ubuntu:25.10openjpeg22.5.3-2.1UBUNTU-CVE-2025-54874
Ubuntu:26.04:LTSopenjpeg22.5.3-2.1UBUNTU-CVE-2025-54874
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2025-54874
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2025-54874
Ubuntu:25.10texmakerno fix listedUBUNTU-CVE-2025-54874
Ubuntu:26.04:LTStexmakerno fix listedUBUNTU-CVE-2025-54874
Ubuntu:26.10texmakerno fix listedUBUNTU-CVE-2025-54874

Affected products (as reported)

VendorProductVersions
uclouvain openjpeg >= 2.5.1, <= 2.5.3

Weakness: CWE-457 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References