CVE-2026-51808

Deferred Deferred - Pending Action

Buffer Overflow in OpenHTJ2K Image Decoder

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: MITRE

Description

Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded function in source/core/interface/decoder.cpp

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-51808

EUVD

EUVD-2026-44581

Affected Vendors & Products

Vendor	Product	Version / Range
openhtj2k	openhtj2k	to 0.18.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in OpenHTJ2K versions 0.18.4 and earlier. It occurs in specific decoder functions where improper input handling allows an attacker to execute arbitrary code by exploiting memory corruption.

Impact Analysis

An attacker could exploit this to run malicious code on your system, potentially gaining control over it. This could lead to data theft, system damage, or unauthorized access if OpenHTJ2K is used in your environment.

Compliance Impact

The vulnerability allows arbitrary code execution due to a buffer overflow, which could lead to unauthorized data access, modification, or exfiltration. This may impact compliance with GDPR (data protection) and HIPAA (health data security) by enabling breaches of confidentiality and integrity.

Mitigation Strategies

Update OpenHTJ2K to a version later than v0.18.4 to address the buffer overflow vulnerability. If updating is not possible, consider disabling or restricting access to the vulnerable functions in decoder.cpp until a patch is applied.

Hi! I’m here to help you understand CVE-2026-51808. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70