CVE-2026-51807: OpenHTJ2K Buffer Overflow Vulnerability

CVE-2026-51807 Overview

CVE-2026-51807 is a heap-based out-of-bounds write [CWE-121] in the OpenHTJ2K JPEG 2000 codec library. The flaw resides in j2k_precinct_subband::parse_packet_header() within source/core/coding/coding_units.cpp. Missing bounds validation allows coding-pass lengths to be written past the fixed-size j2k_codeblock::pass_length[128] array. A crafted JPEG 2000 codestream containing malformed PPM packet headers triggers heap corruption and process termination. All OpenHTJ2K versions up to and including 0.18.3 are affected. The maintainer released a fix in version 0.18.4.

Critical Impact
A single malformed JPEG 2000 file processed by an unpatched OpenHTJ2K build can corrupt heap memory, terminate the host process, and potentially enable remote code execution over the network without authentication or user interaction.

Affected Products

OpenHTJ2K versions 0.18.3 and earlier
Applications embedding the OpenHTJ2K JPEG 2000 codec
Downstream image processing pipelines consuming untrusted JPEG 2000 codestreams

Discovery Timeline

2026-07-14 - CVE-2026-51807 published to the National Vulnerability Database
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-51807

Vulnerability Analysis

OpenHTJ2K parses JPEG 2000 codestreams that carry Packed Packet Headers (PPM) describing how coded image data is organized into codeblocks. Each codeblock tracks the byte length of every coding pass in a fixed-size array, j2k_codeblock::pass_length[128]. During PPM header parsing, j2k_precinct_subband::parse_packet_header() writes coding-pass length values into this array without validating that the pass index remains within the 128-entry bound. When a malformed codestream advertises more coding passes than the array can hold, the parser writes past the end of the heap allocation. The result is deterministic heap corruption on any process ingesting an attacker-supplied image.

Root Cause

The root cause is missing bounds validation before the write into pass_length[128]. The parser trusted values decoded from untrusted codestream data to remain within the compile-time array size. The fix introduces an explicit maximum: constexpr uint8_t kMaxCodingPasses = 128;, and enforces it before each write.

Attack Vector

Exploitation requires only that a vulnerable application decode an attacker-controlled JPEG 2000 file. The attack vector is network-reachable through any service that accepts, thumbnails, transcodes, or previews JP2 images. No authentication or user interaction is required beyond image ingestion.

cpp

// Patch excerpt from source/core/coding/coding_units.cpp (v0.18.4)
 #endif
 
 namespace {
+
+// Maximum number of coding passes for j2k_codeblock::pass_length[] array
+constexpr uint8_t kMaxCodingPasses = 128;
+
 // RAII guard for placement-new array construction loops.
 //
 // Pattern:
// Source: https://github.com/osamu620/OpenHTJ2K/commit/0778b93

The patch introduces the kMaxCodingPasses constant used by the packet-header parser to reject codestreams that would exceed the pass_length[128] array bound.

Detection Methods for CVE-2026-51807

Indicators of Compromise

Unexpected crashes or SIGABRT terminations in processes that decode JPEG 2000 (.jp2, .j2k, .jpx) files
Heap corruption reports from AddressSanitizer, glibc malloc_check, or Windows Fault Reporting for services linking OpenHTJ2K
Ingest of JPEG 2000 files whose PPM marker segments declare coding-pass counts greater than 128 per codeblock

Detection Strategies

Inventory build systems and container images for OpenHTJ2K versions at or below 0.18.3 using software composition analysis
Instrument image-processing services with AddressSanitizer in pre-production to surface out-of-bounds writes in parse_packet_header()
Add file-format inspection at ingress to flag JPEG 2000 codestreams with anomalous PPM marker structures

Monitoring Recommendations

Alert on repeated crashes of image decoders, thumbnail workers, or media pipelines correlated with JPEG 2000 uploads
Capture and retain crash dumps from any process embedding OpenHTJ2K to enable retroactive triage
Monitor egress from image-processing hosts for unexpected outbound connections that could indicate post-exploitation activity

How to Mitigate CVE-2026-51807

Immediate Actions Required

Upgrade OpenHTJ2K to version 0.18.4 or later in all applications, containers, and build pipelines
Rebuild and redeploy any downstream binaries that statically link OpenHTJ2K
Restrict which services accept externally supplied JPEG 2000 files until patched builds are in production

Patch Information

The fix is available in OpenHTJ2K v0.18.4 and referenced in the GitHub commit 0778b93. Review the version comparison 0778b93...v0.18.4 and the OpenHTJ2K release notes to confirm the patch is present in your build.

Workarounds

Disable JPEG 2000 decoding paths in applications where the format is not required
Sandbox image decoders with seccomp, AppArmor, or equivalent controls to contain heap corruption to a low-privilege process
Enforce upload filters that reject .jp2, .j2k, and .jpx files at the perimeter until patched builds are deployed

bash

# Verify the installed OpenHTJ2K version and update via source build
git clone https://github.com/osamu620/OpenHTJ2K.git
cd OpenHTJ2K
git checkout v0.18.4
mkdir build && cd build
cmake .. -DCMAKE_BUILD_TYPE=Release
cmake --build . --parallel

# Confirm the patched constant is present in the source tree
grep -n "kMaxCodingPasses" ../source/core/coding/coding_units.cpp