OP
Product
openjpeg
by uclouvain · last CVE Apr 13, 2026
83
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 28Medium 37Low 1
Watch

Add openjpeg to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-50952
6.5
0%
Aug 7
openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c
Affected: 2.5.0
CVE-2023-39329
6.5
1%
Jul 13
A flaw was found in OpenJPEG
Affected: 2.0; 2.5.0
CVE-2020-15389
6.5
3%
Jun 29
jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the…
Affected: through 2.3.1
CVE-2018-20846
6.5
2%
Jun 26
Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow…
Affected: through 2.3.0
CVE-2018-20845
6.5
2%
Jun 26
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial…
Affected: through 2.3.0
CVE-2019-6988
6.5
2%
Jan 28
An issue was discovered in OpenJPEG 2.3.0
Affected: 2.3.0
CVE-2018-18088
6.5
2%
Oct 9
OpenJPEG 2.3.0 has a NULL pointer dereference for "red" in the imagetopnm function of jp2/convert.c
Affected: 2.3.0
CVE-2016-9572
6.5
2%
Aug 1
A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images
Affected: 2.1.2
CVE-2018-5785
6.5
2%
Jan 19
In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c)
Affected: 2.3.0
CVE-2018-5727
6.5
2%
Jan 16
In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c)
Affected: 2.3.0
CVE-2015-1239
6.5
1%
Oct 18
Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service…
Affected: before 2.1.1
CVE-2016-10507
6.5
2%
Aug 30
Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer…
Affected: through 2.1.2
CVE-2016-10506
6.5
3%
Aug 30
Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a…
Affected: through 2.1.2
CVE-2016-10505
6.5
2%
Aug 30
NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb…
Affected: through 2.1.2
CVE-2016-10504
6.5
8%
Aug 30
Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash)…
Affected: through 2.1.2
CVE-2016-9117
6.5
3%
Oct 30
NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2
Affected: 2.1.2
CVE-2016-9116
6.5
2%
Oct 30
NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2
Affected: 2.1.2
CVE-2016-9115
6.5
2%
Oct 30
Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2
Affected: 2.1.2
CVE-2016-1924
6.5
3%
Jan 27
The opj_tgt_reset function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image
Affected: through 2.1.0
CVE-2016-1923
6.5
2%
Jan 27
Heap-based buffer overflow in the opj_j2k_update_image_data function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application…
Affected: 2.1.0
CVE-2023-39328
5.5
0%
Jul 9
A vulnerability was found in OpenJPEG similar to CVE-2019-6988
Affected: 2.0; 2.5.0
CVE-2022-1122
5.5
1%
Mar 29
A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files
Affected: 2.4.0
CVE-2020-27824
5.5
2%
May 13
A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function
Affected: before 2.4.0
CVE-2021-29338
5.5
2%
Apr 14
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS)
Affected: 2.4.0
CVE-2020-27845
5.5
2%
Jan 5
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0
Affected: before 2.4.0
CVE-2020-27843
5.5
2%
Jan 5
A flaw was found in OpenJPEG in versions prior to 2.4.0
Affected: before 2.4.0
CVE-2020-27842
5.5
2%
Jan 5
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0
Affected: before 2.4.0
CVE-2020-27841
5.5
1%
Jan 5
There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c
Affected: before 2.4.0
CVE-2016-3182
5.5
2%
Feb 20
The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corruption) via a crafted jpeg 2000 file
Affected: before 2.1.1
CVE-2019-12973
5.5
3%
Jun 26
In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c
Affected: 2.3.1
CVE-2018-6616
5.5
2%
Feb 4
In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c
Affected: 2.3.0
CVE-2017-12982
5.5
3%
Aug 21
The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of…
Affected: before 2.3.0
CVE-2016-4797
5.5
2%
Feb 3
Divide-by-zero vulnerability in the opj_tcd_init_tile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (application crash) via a…
Affected: through 2.1.0
CVE-2016-4796
5.5
4%
Feb 3
Heap-based buffer overflow in the color_cmyk_to_rgb in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (crash) via a crafted .j2k file
Affected: through 2.1.0
CVE-2016-3183
5.5
3%
Feb 3
The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg2000 file
Affected: through 2.1.0
CVE-2016-9118
5.3
3%
Oct 30
Heap Buffer Overflow (WRITE of size 4) in function pnmtoimage of convert.c:1719 in OpenJPEG 2.1.2
Affected: 2.1.2
CVE-2023-39327
4.3
1%
Jul 13
A flaw was found in OpenJPEG
Affected: 2.0; 2.5.0
Showing 37