Low severity · published Apr 13, 2026
CVE-2026-6192
uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openjpeg · uclouvain
2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6192
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6192
github.com
https://github.com/uclouvain/openjpeg/
github.com
https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951
github.com
https://github.com/uclouvain/openjpeg/issues/1619
github.com
https://github.com/uclouvain/openjpeg/pull/1628
vuldb.com
https://vuldb.com/submit/797385
vuldb.com
https://vuldb.com/vuln/357114
More from openjpeg
9.8
CVE-2025-54874
OpenJPEG is an open-source JPEG 2000 codec
9.8
CVE-2018-7648
An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0
9.8
CVE-2017-17480
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c
9.8
CVE-2017-17479
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c
9.8
CVE-2015-8871
Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors