CVE-2025-54874: OpenJPEG allows OOB heap memory write in opj_jp2_read_header
OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG 2.5.3 and earlier, a call to opjjp2readheader may lead to OOB heap memory write when the data stream pstream is too short and pimage is not initialized.
Other sources
OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opjjp2readheader may lead to OOB heap memory write when the data stream pstream is too short and pimage is not initialized.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54874?
CVE-2025-54874 has been classified as a high-severity vulnerability due to the potential for out-of-bounds heap memory writes.
How can I fix CVE-2025-54874?
To remediate CVE-2025-54874, upgrade to OpenJPEG version 2.5.4 or later, where the vulnerability has been addressed.
What types of issues can CVE-2025-54874 cause?
CVE-2025-54874 can lead to application crashes or possible code execution due to the out-of-bounds memory access.
Which versions of OpenJPEG are affected by CVE-2025-54874?
OpenJPEG versions 2.5.3 and earlier are affected by CVE-2025-54874.
Is there any known exploit for CVE-2025-54874?
As of now, there are no widely publicized exploits specifically targeting CVE-2025-54874.