CVE-2025-54874

CRITICAL

OpenJPEG <2.5.4 - Memory Corruption

Title source: llm

Description

OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.

Exploits (1)

github WORKING POC
by cyhe50 · cpoc
https://github.com/cyhe50/cve-2025-54874-poc

References (3)

Scores

CVSS v3 9.8
EPSS 0.0009
EPSS Percentile 26.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-457
Status published
Products (1)
uclouvain/openjpeg < 2.5.3
Published Aug 05, 2025
Tracked Since Feb 18, 2026