Search for vulnerabilities
Vulnerability details: VCID-bezp-5u19-9be7
Vulnerability ID VCID-bezp-5u19-9be7
Aliases CVE-2025-54874
Summary OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG 2.5.3 and earlier, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.
Status Published
Exploitability 0.5
Weighted Severity 7.2
Risk 3.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-457 Use of Uninitialized Variable
System Score Found at
cvssv3 8.0 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-54874.json
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00013 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
epss 0.00061 https://api.first.org/data/v1/epss?cve=CVE-2025-54874
cvssv3.1 7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv4 6.6 https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d
ssvc Track* https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d
cvssv4 6.6 https://github.com/uclouvain/openjpeg/pull/1573
ssvc Track* https://github.com/uclouvain/openjpeg/pull/1573
cvssv4 6.6 https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV
ssvc Track* https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-54874.json
https://api.first.org/data/v1/epss?cve=CVE-2025-54874
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1110443 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1110443
1573 https://github.com/uclouvain/openjpeg/pull/1573
2386543 https://bugzilla.redhat.com/show_bug.cgi?id=2386543
CVE-2025-54874 https://nvd.nist.gov/vuln/detail/CVE-2025-54874
f809b80c67717c152a5ad30bf06774f00da4fd2d https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d
GHSL-2025-057_OpenCV https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV
RHSA-2025:13944 https://access.redhat.com/errata/RHSA-2025:13944
USN-7757-1 https://usn.ubuntu.com/7757-1/
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-54874.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-08-05T14:49:23Z/ Found at https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/uclouvain/openjpeg/pull/1573
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-08-05T14:49:23Z/ Found at https://github.com/uclouvain/openjpeg/pull/1573
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-08-05T14:49:23Z/ Found at https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV
Exploit Prediction Scoring System (EPSS)
Percentile 0.01413
EPSS Score 0.00013
Published At Aug. 6, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-08-06T08:02:06.043989+00:00 SUSE Severity Score Importer Import https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml 37.0.0