CVE-2026-6192: 
Ghostscript vulnerability analysis and mitigation

CVE-2026-6192 is an integer overflow vulnerability in the opj_pi_initialise_encode() function within src/lib/openjp2/pi.c of the uclouvain OpenJPEG library. It affects all versions up to and including 2.5.4 (specifically confirmed on versions 2.5.0 through 2.5.4). The vulnerability was reported on January 14, 2026, the fix was merged on April 5, 2026, and the CVE was published on April 13, 2026. It carries a CVSS v3.1 base score of 3.3 (Low) (Github Advisory, Feedly).

The root cause is CWE-190 (Integer Overflow or Wraparound) in the encode path of opj_pi_initialise_encode() at pi.c:1687–1698. The include_size variable is computed via a chain of 32-bit unsigned integer multiplications (numlayers × l_max_res × numcomps × l_max_prec) without overflow guards; when the product exceeds UINT32_MAX (4,294,967,295), it wraps around, causing a smaller-than-required heap buffer to be allocated via opj_calloc(). Subsequent accesses to the include[] array in opj_pi_next_*() functions then exceed the allocated bounds, resulting in out-of-bounds heap access. Notably, the decode path opj_pi_create_decode() already contained equivalent overflow protection at pi.c:1474–1481, but the encode path lacked it. Exploitation requires local access and the ability to supply a crafted JPEG 2000 image with extreme encoding parameters (e.g., large image dimensions, many components, layers, and small precinct sizes) (GitHub Issue, GitHub Commit).

Successful exploitation causes a denial of service (DoS) condition by triggering an out-of-bounds heap access during JPEG 2000 encoding, which results in an encoding failure or application crash. There is no confidentiality or integrity impact — only availability is affected, and only to the local process performing the encoding. The vulnerability does not enable remote code execution or privilege escalation under normal conditions, though in production builds without runtime bounds checks, the heap buffer overflow could theoretically lead to memory corruption (GitHub Issue, Github Advisory).

A proof-of-concept demonstrating the integer overflow and resulting out-of-bounds access was included in the original bug report and is publicly available (GitHub Issue). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.013–0.017%, placing it in the 4th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVE status is marked as "Deferred" (Github Advisory, Feedly).

1. Prepare a crafted JPEG 2000 encoding scenario: Construct or configure an image with parameters designed to trigger the overflow — for example, a 3584×3584 image with 150 components, 100 layers, 6 resolutions, and a 16×16 precinct size. These values cause numlayers × l_max_res × numcomps × l_max_prec = 100 × 6 × 150 × 50,176 = 4,515,840,000, which exceeds UINT32_MAX.
2. Invoke the OpenJPEG encoder: Pass the crafted image to any application using the vulnerable opj_pi_initialise_encode() code path (e.g., via the opj_compress command-line tool or a library-linked application) with the above encoding parameters.
3. Trigger the integer overflow: During encoding, include_size is computed as a 32-bit value and wraps around to 220,872,704 instead of the correct 4,515,840,000, causing opj_calloc() to allocate a truncated buffer (~442 MB instead of ~9 GB).
4. Cause out-of-bounds access: As opj_pi_next_*() functions compute indices into the include[] array, indices exceed the allocated buffer size, triggering either a runtime error ("Invalid access to pi->include"), application crash, or heap corruption in builds without runtime bounds checks (GitHub Issue).

• Logs: Application error logs containing repeated messages "Invalid access to pi->include" originating from OpenJPEG's opj_pi_next_*() functions during JPEG 2000 encoding operations.
• Process Behavior: Unexpected crashes or abnormal termination of applications using the OpenJPEG library during encoding of images with extreme parameters (very large dimensions, high component/layer counts, small precinct sizes).
• File System: Presence of crafted JPEG 2000 files with unusual encoding parameters (e.g., extremely high numcomps, numlayers, or small precinct sizes) submitted to encoding pipelines.

Apply the upstream patch committed on April 5, 2026, identified by commit hash 839936aa33eb8899bbbd80fda02796bb65068951 in the OpenJPEG repository. The fix adds an overflow guard (if (l_step_l <= UINT_MAX / l_tcp->numlayers)) to opj_pi_initialise_encode(), mirroring the protection already present in the decode path. Downstream distributions including Debian (via debian-lts-announce) and Ubuntu have issued updated packages. Where patching is not immediately possible, restrict local access to systems running vulnerable OpenJPEG versions and avoid processing untrusted JPEG 2000 files with extreme encoding parameters (GitHub PR, GitHub Commit, Github Advisory).

The vulnerability was reported by researcher "Keryero" via a detailed GitHub issue on January 14, 2026, including a thorough root cause analysis and proof-of-concept. OpenJPEG maintainer "rouault" merged the fix on April 5, 2026, with a straightforward patch mirroring the existing decode-path protection. Downstream package maintainers for NixOS and OSGeo4W referenced the fix promptly after the CVE was published. No significant broader media coverage or social media discussion has been observed beyond standard vulnerability tracking channels.