---
id: CVE-2026-107080
title: >-
  OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains
  an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in
  src/lib/openjp2/dwt.c
summary: >-
  OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains
  an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in
  src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.
severity: none
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T15:32:56.608Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107080'
references:
  - url: 'https://github.com/uclouvain/openjpeg/issues/1673'
  - url: 'https://github.com/uclouvain/openjpeg/pull/1674'
  - url: >-
      https://github.com/uclouvain/openjpeg/commit/a38e970fa59abd796c703ec469e578b09f7ffa33
  - url: 'https://www.openwall.com/lists/oss-security/2026/10/05/5'
tags:
  - cve.org
ingestedAt: '2026-10-26T16:31:40.070Z'
---

## Overview

OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.