CVE-2026-51807 Memory corruption in n/a
A crafted JPEG 2000 file can trigger a heap-based out-of-bounds write in OpenHTJ2K, causing heap corruption and process termination.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-51807?
CVE-2026-51807 is a critical memory corruption vulnerability in n/a, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) caused by missing bounds validation before coding-pass lengths are written to j2k_codeblock::pass_length[128]. A crafted JPEG 2000 codestream containing malformed PPM packet headers can trigger a heap-based out-of-bounds write in j2k_precinct_subband::parse_packet_header() in source/core/coding/coding_units.cpp due to missing bounds validation for the j2k_codeblock::pass_length[128] array which can lead to heap corruption and process termination.
Weakness: CWE-121
Which versions are affected by CVE-2026-51807?
How do I fix CVE-2026-51807?
No fix has been published for CVE-2026-51807 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-51807 being exploited?
There is no known exploitation of CVE-2026-51807 in the wild and no public exploit code.
Sources
Also known as GHSA-hr36-79f7-75x7.