CVE-2026-51808

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-51808

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-51808.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-51808

Published

2026-07-14T00:00:00Z

Modified

2026-08-12T16:09:43Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded function in source/core/interface/decoder.cpp

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/51xxx/CVE-2026-51808.json"
}

References

Affected packages

Git / github.com/osamu620/openhtj2k

Affected ranges

Type

GIT

Repo

https://github.com/osamu620/openhtj2k

Events

Introduced

Fixed

a87464934d3bd1a9b50e019cc439e437cfc4892c

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

v.*

v.0.2.8

v0.*

v0.10.0

v0.11.0

v0.11.1

v0.12.0

v0.13.0

v0.13.1

v0.13.2

v0.14.0

v0.15.0

v0.15.1

v0.15.2

v0.16.0

v0.16.1

v0.17.0

v0.17.1

v0.17.2

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.2

v0.2.1

v0.2.2

v0.2.5

v0.2.6

v0.2.7

v0.2.9

v0.3.0

v0.3.1

v0.4.0

v0.4.1

v0.5.0

v0.5.1

v0.6.0

v0.7.0

v0.7.1

v0.8.0

v0.9.0

v0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-51808.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "5727997355110328467755574335062438198",
            "length": 2897
        },
        "id": "CVE-2026-51808-32570780",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/osamu620/openhtj2k/commit/a87464934d3bd1a9b50e019cc439e437cfc4892c",
        "target": {
            "file": "source/core/interface/decoder.cpp",
            "function": "openhtj2k_decoder_impl::invoke_line_based_predecoded"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "120407733231861666051677741487769135022",
                "159430271830208011960314915886651313739",
                "134642408427855751522275053915459191796",
                "61952044023103372143377484214544305424",
                "120407733231861666051677741487769135022",
                "159430271830208011960314915886651313739",
                "134642408427855751522275053915459191796",
                "61952044023103372143377484214544305424",
                "120407733231861666051677741487769135022",
                "159430271830208011960314915886651313739",
                "134642408427855751522275053915459191796",
                "243596785899206082669378280420052468406",
                "120407733231861666051677741487769135022",
                "159430271830208011960314915886651313739",
                "134642408427855751522275053915459191796",
                "61952044023103372143377484214544305424"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-51808-c5769562",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/osamu620/openhtj2k/commit/a87464934d3bd1a9b50e019cc439e437cfc4892c",
        "target": {
            "file": "source/core/interface/decoder.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "263976289262409140136736982229246063401",
            "length": 3043
        },
        "id": "CVE-2026-51808-df0e4d21",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/osamu620/openhtj2k/commit/a87464934d3bd1a9b50e019cc439e437cfc4892c",
        "target": {
            "file": "source/core/interface/decoder.cpp",
            "function": "openhtj2k_decoder_impl::invoke"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "310881787698693312197805576759224696970",
            "length": 2964
        },
        "id": "CVE-2026-51808-f7fde46a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/osamu620/openhtj2k/commit/a87464934d3bd1a9b50e019cc439e437cfc4892c",
        "target": {
            "file": "source/core/interface/decoder.cpp",
            "function": "openhtj2k_decoder_impl::invoke_line_based"
        }
    }
]

vanir_signatures_modified

"2026-08-12T16:09:43Z"