How severe is CVE-2025-54874?

CVE-2025-54874 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-54874 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-54874?

CVE-2025-54874 affects Uclouvain Openjpeg. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-54874?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-54874 have an EU (EUVD) identifier?

Yes. CVE-2025-54874 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23631.

When was CVE-2025-54874 published?

CVE-2025-54874 was published on 2025-08-05 and last updated on 2026-06-17.

CVE-2025-54874

CVE-2025-54874 is a critical-severity vulnerability in Uclouvain Openjpeg with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-457.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 6.6
EPSS exploit prediction: 1% (46th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-23631
Weakness: CWE-457
Affected product: Uclouvain Openjpeg
Published: 2025-08-05
Last modified: 2026-06-17

Description

OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.

Frequently asked questions

What is CVE-2025-54874?: OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.
How severe is CVE-2025-54874?: CVE-2025-54874 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-54874 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (46th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-54874?: CVE-2025-54874 affects Uclouvain Openjpeg. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-54874?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-54874 have an EU (EUVD) identifier?: Yes. CVE-2025-54874 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23631.
When was CVE-2025-54874 published?: CVE-2025-54874 was published on 2025-08-05 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:*

More vulnerabilities in Uclouvain Openjpeg

CVE-2013-4290 — Critical (CVSS 10.0): Stack-based buffer overflow in OpenJPEG before 1.5.2 allows remote attackers to have unspecified impact via unknown…
CVE-2013-4289 — Critical (CVSS 10.0): Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPEG before 1.5.2 allow remote attackers to have unspecified…
CVE-2012-3358 — Critical (CVSS 10.0): Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to…
CVE-2018-7648 — Critical (CVSS 9.8): An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which…
CVE-2017-17480 — Critical (CVSS 9.8): In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The…
CVE-2017-17479 — Critical (CVSS 9.8): In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The…

All CVEs affecting Uclouvain Openjpeg →

Other CWE-457 vulnerabilities

CVE-2026-6748 — Critical (CVSS 9.8): Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR…
CVE-2025-53644 — Critical (CVSS 9.8): OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on…
CVE-2026-14405 — Critical (CVSS 9.6): Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code…
CVE-2026-13825 — High (CVSS 8.8): Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap…
CVE-2025-5749 — High (CVSS 8.8): WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This…
CVE-2025-20271 — High (CVSS 8.6): A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway…

Browse all CWE-457 vulnerabilities →