CVE-2026-6192

Low

Description

A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.

SeverityLow

CVSS3.3

Exploit probability—

ProductUclouvain Openjpeg

PublishedApr 13, 2026

First seenApr 13, 2026

Weakness typeCWE-190Integer overflow CWE-189CWE-189

How to fix

Patches

github.com/uclouvain/openjpeg/pull/1628
github.com/uclouvain/openjpeg/commit/839936aa33eb8899bbbd80fda02796bb65068951

Affected products

Product	Affected versions	Fixed in
uclouvain openjpeg	2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.