{"schema":"threatline.record/2","record":{"id":"CVE-2026-111151","aliases":[],"summary":"OpenJPH through 0.32.0 Heap Out-of-Bounds Write in HTJ2K Cleanup-Pass Decoder","details":"OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the HTJ2K cleanup-pass decoder that allows attackers to corrupt memory via one-row codeblocks. Attackers can supply a crafted .j2c or .jph codestream with small precinct sizes, causing the decoder to write a second row past the codeblock buffer, resulting in memory corruption and crashes.","categories":["Unclassified"],"product":"OpenJPH","vendor":"aous72","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111151","source_modified_at":"2026-10-15T19:36:21.172Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"OpenJPH","vendor":"aous72","versions":[{"version":"0","lessThanOrEqual":"0.32.0","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0013,"percentile":0.02362,"score_date":"2026-10-23"},"published_at":"2026-10-15T18:57:40.179Z","modified_at":"2026-10-15T19:36:21.172Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-111151","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T19:36:21.172Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111151","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haind-pwn/openjph-htj2k-degenerate-codeblock-cleanup-oob-write","tags":["technical-description","exploit"]},{"source":"CVE List","url":"https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/codestream/ojph_subband.cpp#L136-L142","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/codestream/ojph_codeblock.cpp#L79-L84","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/aous72/OpenJPH/blob/23c422895ce6c3a156935222e4715ee0b7be952c/src/core/coding/ojph_block_decoder32.cpp#L1135-L1155","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/aous72/OpenJPH","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/openjph-through-0.32.0-heap-out-of-bounds-write-in-htj2k-cleanup-pass-decoder","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T19:36:04.656151Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T19:36:21.172Z","content_hash":"6e4bd56a627cdc3ecac6d6b1214500c3fd0dd94e85b8574782d8b4b8e0e3c499"}}