Critical Security Update for OpenJPEG2: Out-of-Bounds Heap Memory Write Vulnerability
Summary
ALSA-2025:13944: Important: openjpeg2 security update. Affects openjpeg2 versions < 2.5.2-4.el10_0.1. Fixed in 2.5.2-4.el10_0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source library designed for reading and writing image files in the JPEG2000 format. It provides essential functionalities for image processing and is widely used in various applications that require high-quality image compression. The library is known for its efficiency and flexibility, making it a popular choice among developers. However, it has recently been identified that certain versions of OpenJPEG are susceptible to a critical vulnerability that could lead to severe security implications.
Vulnerability Detail
The vulnerability identified as CVE-2025-54874 is an out-of-bounds (OOB) heap memory write issue within the OpenJPEG library. This flaw allows an attacker to exploit the library by manipulating input data, potentially leading to arbitrary code execution or crashing the application. The vulnerability originates from improper handling of memory allocation, which can be exploited if an attacker crafts a specific JPEG2000 file. The ramifications of this vulnerability are significant, as it could compromise the integrity and confidentiality of the affected systems.
How To Fix
Minimum fixed version
2.5.2-4.el10_0.1
This is the first release that contains the fix.
sudo dnf update openjpeg2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the vulnerable versions of the OpenJPEG library until the update is applied. Ensure that any applications relying on OpenJPEG are configured to handle image files safely and do not process untrusted input.
Conclusion
In summary, the OpenJPEG library has a critical vulnerability that requires immediate attention. Users are advised to update to the patched version to mitigate risks associated with CVE-2025-54874. Regular monitoring and prompt updates are essential to maintain the security of applications relying on this library.
See every vulnerability recorded for openjpeg2 →
FAQ
OpenJPEG is an open-source library used for reading and writing JPEG2000 image files, known for its efficiency and flexibility.
CVE-2025-54874 refers to a critical out-of-bounds heap memory write vulnerability found in the OpenJPEG library.
Exploitation of this vulnerability can lead to arbitrary code execution, potentially compromising the security of your application and its data.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If immediate updates are not possible, ensure that your applications do not process untrusted JPEG2000 files and consider implementing additional security measures.
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg2.
