# openjpeg 2.5.4

Official repository of the OpenJPEG project

Snapshot of gominimal/pkgs commit `dc9f81d296f8795287a37d9387a66d57c46416e3` (pushed 2026-07-27T08:13:14.000Z).

## Install

```sh
min add openjpeg
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| OSV-2025-219 | HIGH | — | fixed | — | Heap-buffer-overflow in opj_j2k_read_tile_header |

## Transitive advisories

9 advisories inherited through runtime dependencies:

- CVE-2026-40930 (MEDIUM) via libpng
- CVE-2013-4412 (HIGH) via glibc
- CVE-2026-4046 (HIGH) via glibc
- CVE-2026-4437 (HIGH) via glibc
- CVE-2026-4438 (MEDIUM) via glibc
- CVE-2026-5435 (HIGH) via glibc
- CVE-2026-5450 (CRITICAL) via glibc
- CVE-2026-5928 (HIGH) via glibc
- CVE-2026-6238 (MEDIUM) via glibc

## Dependencies

- Build (4): base, toolchain, make, cmake
- Runtime (3): lcms2, libpng, glibc

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 40 | low |
| advisories | 10 | low |
| quality | 43 | low |
| maintenance | 50 | mid |
| licence | 90 | good |

## Links

- Package page (HTML): https://minimal.dev/pkgs/openjpeg
- JSON API (floats latest): https://minimal.dev/api/pkgs/openjpeg.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/openjpeg/sbom.json