# CVE-2025-54874: libopenjpip-viewer: OpenJPEG is an open-source JPEG 2000 codec

CVE-2025-54874 is fixed in 9 products on 1 platform, first by libopenjp2-7 2.5.3-2.1, released August 5, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-54874
- Priority: High
- CVSS: 9.8 (Medium)
- EPSS: 0.0066
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 5, 2025

## Description

OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write whenthe data stream p_stream is too short and p_image is not initialized.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | chromium opensuse-leap 16.0 | 142.0.7444.162-bp160.1.1 | [OPENSUSE-SU-2025:20076-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2025-20076-1.md) | Aug 31, 2026 |
| Linux | libopenjp2-7 Ubuntu 25.04 (plucky) | 2.5.3-2ubuntu0.1 | [libopenjp2-7 2.5.3-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libopenjp2-7-2.5.3-2ubuntu0.1.md) | Jan 16, 2026 |
| Linux | libopenjp2-7 Ubuntu 25.10 (questing) | 2.5.3-2.1 | [libopenjp2-7 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libopenjp2-7-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | libopenjp2-7 Ubuntu 26.04.1 LTS (resolute) | 2.5.3-2.1 | [libopenjp2-7 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libopenjp2-7-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | libopenjp2-tools Ubuntu 25.04 (plucky) | 2.5.3-2ubuntu0.1 | [libopenjp2-tools 2.5.3-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libopenjp2-tools-2.5.3-2ubuntu0.1.md) | Jan 16, 2026 |
| Linux | libopenjp2-tools Ubuntu 25.10 (questing) | 2.5.3-2.1 | [libopenjp2-tools 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libopenjp2-tools-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | libopenjp2-tools Ubuntu 26.04.1 LTS (resolute) | 2.5.3-2.1 | [libopenjp2-tools 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libopenjp2-tools-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | libopenjpip-dec-server Ubuntu 25.04 (plucky) | 2.5.3-2ubuntu0.1 | [libopenjpip-dec-server 2.5.3-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libopenjpip-dec-server-2.5.3-2ubuntu0.1.md) | Jan 16, 2026 |
| Linux | libopenjpip-dec-server Ubuntu 25.10 (questing) | 2.5.3-2.1 | [libopenjpip-dec-server 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libopenjpip-dec-server-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | libopenjpip-dec-server Ubuntu 26.04.1 LTS (resolute) | 2.5.3-2.1 | [libopenjpip-dec-server 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libopenjpip-dec-server-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | libopenjpip-viewer Ubuntu 25.04 (plucky) | 2.5.3-2ubuntu0.1 | [libopenjpip-viewer 2.5.3-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libopenjpip-viewer-2.5.3-2ubuntu0.1.md) | Jan 16, 2026 |
| Linux | libopenjpip-viewer Ubuntu 25.10 (questing) | 2.5.3-2.1 | [libopenjpip-viewer 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libopenjpip-viewer-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | libopenjpip-viewer Ubuntu 26.04.1 LTS (resolute) | 2.5.3-2.1 | [libopenjpip-viewer 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libopenjpip-viewer-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | libopenjpip7 Ubuntu 25.04 (plucky) | 2.5.3-2ubuntu0.1 | [libopenjpip7 2.5.3-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libopenjpip7-2.5.3-2ubuntu0.1.md) | Jan 16, 2026 |
| Linux | libopenjpip7 Ubuntu 25.10 (questing) | 2.5.3-2.1 | [libopenjpip7 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libopenjpip7-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | libopenjpip7 Ubuntu 26.04.1 LTS (resolute) | 2.5.3-2.1 | [libopenjpip7 2.5.3-2.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libopenjpip7-2.5.3-2.1.md) | Aug 5, 2025 |
| Linux | openjpeg2 Debian 13.5 (trixie) | 2.5.3-2.1~deb13u1 | [DEBIAN-CVE-2025-54874](https://patchblox.com/security/data/fix/linux/debian-cve-2025-54874.md) | Aug 5, 2025 |
| Linux | openjpeg2 Debian 14 | 2.5.3-2.1 | [DEBIAN-CVE-2025-54874](https://patchblox.com/security/data/fix/linux/debian-cve-2025-54874.md) | Aug 5, 2025 |
| Linux | openjpeg2 RHEL 10 | 2.5.2-4.el10_0.1 | [RHSA-2025:13944](https://patchblox.com/security/data/fix/linux/rhsa-2025-13944.md) | Aug 5, 2025 |
| Linux | openjpeg2 almalinux 10 | 2.5.2-4.el10_0.1 | [ALSA-2025:13944](https://patchblox.com/security/data/fix/linux/alsa-2025-13944.md) | Aug 18, 2025 |
| Linux | openjpeg2 ol 10 | 0:2.5.2-4.el10_0.1 | [ELSA-2025-13944](https://patchblox.com/security/data/fix/linux/elsa-2025-13944.md) | Aug 18, 2025 |
| Linux | openjpeg2 rocky 10 | 0:2.5.2-4.el10_0.1 | [RLSA-2025:13944](https://patchblox.com/security/data/fix/linux/rlsa-2025-13944.md) | Oct 3, 2025 |
| Linux | openjpeg2 sles 16.0 | 2.5.3-160000.4.1 | [SUSE-SU-2026:21995-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-21995-1.md) | May 29, 2026 |
| Linux | openjpeg2-devel almalinux 10 | 2.5.2-4.el10_0.1 | [ALSA-2025:13944](https://patchblox.com/security/data/fix/linux/alsa-2025-13944.md) | Aug 18, 2025 |
| Linux | openjpeg2-devel ol 10 | 0:2.5.2-4.el10_0.1 | [ELSA-2025-13944](https://patchblox.com/security/data/fix/linux/elsa-2025-13944.md) | Aug 18, 2025 |
| Linux | openjpeg2-tools almalinux 10 | 2.5.2-4.el10_0.1 | [ALSA-2025:13944](https://patchblox.com/security/data/fix/linux/alsa-2025-13944.md) | Aug 18, 2025 |
| Linux | openjpeg2-tools ol 10 | 0:2.5.2-4.el10_0.1 | [ELSA-2025-13944](https://patchblox.com/security/data/fix/linux/elsa-2025-13944.md) | Aug 18, 2025 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.