CVE-2026-51808: OpenHTJ2K Buffer Overflow Vulnerability

CVE-2026-51808 Overview

CVE-2026-51808 is a buffer overflow vulnerability [CWE-120] in OpenHTJ2K, an open-source implementation of the High-Throughput JPEG 2000 (HTJ2K) codec. The flaw affects version 0.18.4 and earlier, residing in the decoder interface at source/core/interface/decoder.cpp. Attackers can trigger the overflow through the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded functions. Successful exploitation allows arbitrary code execution in the context of the process consuming a malicious HTJ2K image stream. Any application, service, or pipeline that decodes untrusted HTJ2K data with a vulnerable OpenHTJ2K build is at risk.

Critical Impact
A remote, unauthenticated attacker can achieve arbitrary code execution by delivering a crafted HTJ2K image to an application linked against OpenHTJ2K ≤ 0.18.4.

Affected Products

OpenHTJ2K version 0.18.4
OpenHTJ2K versions prior to 0.18.4
Applications and services that link or embed vulnerable OpenHTJ2K builds

Discovery Timeline

2026-07-14 - CVE-2026-51808 published to NVD
2026-07-15 - Last updated in NVD database
v0.18.5 - Fixed release published on the OpenHTJ2K GitHub repository

Technical Details for CVE-2026-51808

Vulnerability Analysis

The vulnerability is a classic buffer copy without size checking [CWE-120] inside OpenHTJ2K's decoder implementation. The affected entry points, invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded, all live in source/core/interface/decoder.cpp and expose the public C++ API used by downstream consumers of the library.

When these functions parse attacker-controlled HTJ2K codestream parameters, insufficient bounds enforcement allows a source buffer to be written past the allocated destination. Because HTJ2K decoding runs early in image processing pipelines, exploitation requires no authentication and no user interaction beyond delivering an image the target application chooses to decode.

The network attack vector combined with low complexity means any service that ingests HTJ2K files, such as media transcoders, medical imaging tooling, or content management platforms, becomes a viable target. Corruption of adjacent heap or stack structures can be shaped into arbitrary code execution using well-understood memory corruption techniques.

Root Cause

The decoder trusts codestream-derived dimensions and offsets when populating internal buffers. Missing length validation in the invoke* code paths allows a crafted HTJ2K file to write beyond the bounds of decoder-owned memory, corrupting adjacent allocations.

Attack Vector

Exploitation is remote and unauthenticated. An attacker delivers a malicious HTJ2K image to any process that calls into a vulnerable OpenHTJ2K decoder, for example through a file upload, an email attachment scanned by a preview service, or a networked imaging workflow. See the GitHub Pull Request #320 and the OpenHTJ2K Changelog for the code changes that constrain these parsers.

No public exploit or in-the-wild activity has been reported at the time of publication, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-51808

Indicators of Compromise

Unexpected crashes, segmentation faults, or abort signals originating from processes that invoke OpenHTJ2K decode functions.
HTJ2K (.j2k, .jph, .jhc) files with malformed headers or oversized codestream parameters submitted to imaging pipelines.
Child processes or shell invocations spawned by image processing services shortly after decoding an untrusted file.

Detection Strategies

Inventory all software that statically or dynamically links OpenHTJ2K and identify the version in use via software composition analysis.
Instrument HTJ2K decoder processes with AddressSanitizer or equivalent memory error detection in staging environments to surface exploitation attempts.
Alert on anomalous outbound network connections initiated by image processing workers that historically only perform inbound I/O.

Monitoring Recommendations

Capture process creation, file read, and network telemetry from hosts running HTJ2K decoding workloads and forward to a centralized SIEM.
Baseline expected memory and CPU usage of image decoding services so buffer overflow attempts causing crashes or resource spikes are visible.
Track ingress of HTJ2K file types at web application firewalls and mail gateways to correlate suspicious uploads with downstream process behavior.

How to Mitigate CVE-2026-51808

Immediate Actions Required

Upgrade OpenHTJ2K to v0.18.5 or later across all environments that include the library.
Rebuild and redeploy any application that statically links OpenHTJ2K, since a system-level library update alone will not remediate embedded copies.
Restrict acceptance of HTJ2K content from untrusted sources until the patched version is fully rolled out.

Patch Information

The maintainers fixed the vulnerability in OpenHTJ2K v0.18.5. Review the changes in GitHub Pull Request #320 and the OpenHTJ2K Changelog before upgrading. Verify downstream consumers, such as language bindings and container images, ship the patched release.

Workarounds

Disable HTJ2K decoding in applications where the format is not required.
Sandbox image decoding in a separate low-privilege process or container with seccomp and no outbound network access.
Enforce file size and MIME type validation at ingress to reject malformed HTJ2K payloads before they reach the decoder.

bash

# Build and install the patched OpenHTJ2K release
git clone --branch v0.18.5 https://github.com/osamu620/OpenHTJ2K.git
cd OpenHTJ2K
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel
sudo cmake --install build