Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validation before coding-pass lengths are written to j2k_codeblock::pass_length[128]. A crafted JPEG 2000 codestream containing malformed PPM packet headers can trigger a heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in source/core/coding/coding_units.cpp due to missing bounds validation for the j2k_codeblock::pass_length[128] array which can lead to heap corruption and process termination.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-51807 Buffer Overflow in OpenHTJ2K 0.18.4 Allows Arbitrary Code Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-51807
Post summary
This post announces a buffer‑overflow vulnerability (CVE-2026-51807) in OpenHTJ2K 0.18.4 that can lead to arbitrary code execution, but provides no additional details such as exploitation code or mitigation steps.