QwikSec

Security Database

CVE

CWE

Training

CVE-2026-6192

Published: Apr 13, 2026

Modified: May 21, 2026

PUBLISHED

CVSS v3.1

3.3

LOW

Description

A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.

Vendor	Product	Versions
uclouvain	openjpeg	affected `2.5.0` affected `2.5.1` affected `2.5.2` affected `2.5.3` affected `2.5.4`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

References

VDB-357114 | uclouvain openjpeg pi.c opj_pi_initialise_encode integer overflow

vdb-entry

technical-description

VDB-357114 | CTI Indicators (IOB, IOC, IOA)

signature

permissions-required

Submit #797385 | uclouvain openjpeg 2.5.4 Integer Overflow

third-party-advisory

https://github.com/uclouvain/openjpeg/issues/1619

exploit

issue-tracking

https://github.com/uclouvain/openjpeg/pull/1628

issue-tracking

patch

https://github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951

patch

https://github.com/uclouvain/openjpeg/

product

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.