CVE-2025-8836

EUVD-2025-24133

11.08.2025, 08:15

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.3 LOW	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 15%

Affected Products (NVD)

Vendor	Product	Version
jasper_project	jasper	𝑥 ≤ 4.2.5

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

jasper

jammy	dne
noble	dne
plucky	dne
questing	dne
resolute	dne
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libjasper-devel

suse enterprise desktop 15 SP6	4.2.8-150600.4.5.1 fixed
suse enterprise desktop 15 SP7	4.2.8-150600.4.5.1 fixed
suse enterprise sap 15 SP6	4.2.8-150600.4.5.1 fixed
suse enterprise sap 15 SP7	4.2.8-150600.4.5.1 fixed
suse enterprise server 15 SP4	2.0.14-150000.3.37.1 fixed
suse enterprise server 15 SP6	4.2.8-150600.4.5.1 fixed
suse enterprise server 15 SP7	4.2.8-150600.4.5.1 fixed

libjasper1

suse enterprise server 12 SP3

1.900.14-195.43.1

fixed

libjasper1-32bit

suse enterprise server 12 SP3

1.900.14-195.43.1

fixed

libjasper4

suse enterprise server 15 SP4

2.0.14-150000.3.37.1

fixed

libjasper7

suse enterprise desktop 15 SP6	4.2.8-150600.4.5.1 fixed
suse enterprise desktop 15 SP7	4.2.8-150600.4.5.1 fixed
suse enterprise sap 15 SP6	4.2.8-150600.4.5.1 fixed
suse enterprise sap 15 SP7	4.2.8-150600.4.5.1 fixed
suse enterprise server 15 SP6	4.2.8-150600.4.5.1 fixed
suse enterprise server 15 SP7	4.2.8-150600.4.5.1 fixed

Known Exploits!

Common Weakness Enumeration

CWE-617 - Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References

https://drive.google.com/file/d/1pPgndhHh2z0lk99Wt31W-XIW3XWt8FB3/view?usp=drive_link

https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4

https://github.com/jasper-software/jasper/issues/401

https://vuldb.com/?ctiid.319370

https://vuldb.com/?id.319370

https://vuldb.com/?submit.622409

https://github.com/jasper-software/jasper/issues/401