{"id":"CVE-2026-111151","summary":"OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder","details":"OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes.","modified":"2026-10-17T07:06:38.901522769Z","published":"2026-10-15T18:57:40.179Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111151.json","cna_assigner":"VulnCheck"},"references":[{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111151.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111151"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/openjph-through-0.32.0-heap-out-of-bounds-write-in-htj2k-cleanup-pass-decoder"},{"type":"PACKAGE","url":"https://github.com/aous72/OpenJPH"},{"type":"ARTICLE","url":"https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/codestream/ojph_codeblock.cpp#L79-L84"},{"type":"ARTICLE","url":"https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/codestream/ojph_subband.cpp#L136-L142"},{"type":"ARTICLE","url":"https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/coding/ojph_block_decoder32.cpp#L1135-L1155"},{"type":"EVIDENCE","url":"https://hackmd.io/@haind-pwn/openjph-htj2k-degenerate-codeblock-cleanup-oob-write"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/aous72/openjph","events":[{"introduced":"0"},{"fixed":"23c422895ce6c3a156935222e4715ee0b7be952c"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"last_affected":"0.32.0"},{"fixed":"0.32.0"}]}}],"versions":["0.31.0","0.30.1","0.30.0","0.29.0","0.28.1","0.28.0","0.27.4","0.27.3","0.27.2","0.27.1","0.27.0","0.26.3","0.26.2","0.26.1","0.26.0","0.24.1","0.24.0","0.23.1","0.23.0","0.22.0","0.21.5","0.21.4","0.21.3","0.21.2","0.21.1","0.21.0","0.18.2","0.18.1","0.18.0","0.17.0","0.16.0","0.15.0","0.14.2","0.14.1","0.14.0","0.13.3","0.13.2","0.13.1","0.13.0","0.12.0","0.11.0","0.10.5","0.10.4","0.10.3","0.10.2","0.10.1","0.10.0","0.9.0","0.8.3","0.8.2","0.8.1","0.8.0","0.7.3","0.7.2","0.7.1","0.7.0","0.6.5","0.6.2","0.6.1","0.6.0","0.5.1","0.5.0","0.4.1","0.4.0","0.3.2","0.3.1","0.3.0","0.2.0","0.1.1","0.1.0"],"database_specific":{"vanir_signatures":[{"target":{"file":"tests/test_nlt.cpp"},"deprecated":false,"digest":{"line_hashes":["78321037803398896556630497631384247249","161840443422016050207695177782917619295","313101414956315758438153327280746351739","176459154572104616568727898907354388616"],"threshold":0.9},"id":"CVE-2026-111151-5db5c613","signature_type":"Line","signature_version":"v1","source":"https://github.com/aous72/openjph/commit/23c422895ce6c3a156935222e4715ee0b7be952c"},{"target":{"function":"load_pfm","file":"tests/test_nlt.cpp"},"deprecated":false,"digest":{"function_hash":"261668121471206378689759520596198435598","length":1433},"id":"CVE-2026-111151-7c0756db","signature_type":"Function","signature_version":"v1","source":"https://github.com/aous72/openjph/commit/23c422895ce6c3a156935222e4715ee0b7be952c"},{"signature_version":"v1","source":"https://github.com/aous72/openjph/commit/23c422895ce6c3a156935222e4715ee0b7be952c","target":{"file":"src/core/codestream/ojph_params.cpp","function":"param_nlt::write"},"deprecated":false,"digest":{"function_hash":"82879199618858077384546856612669152331","length":2035},"id":"CVE-2026-111151-9f9d9fce","signature_type":"Function"},{"source":"https://github.com/aous72/openjph/commit/23c422895ce6c3a156935222e4715ee0b7be952c","target":{"file":"src/core/codestream/ojph_params.cpp"},"deprecated":false,"digest":{"line_hashes":["165867265924334287161512115728950389216","46927802976379123291060523177948614041","314464125793506461897047371936138559012","275383480337875247799429239022137791961","48540054878665388839989582767540997360","101437782606770352696179274378322287325","221047070237044347980758563784928546362"],"threshold":0.9},"id":"CVE-2026-111151-eab3b468","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-17T07:06:38Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111151.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}