Login Request a demo
Medium severity · published Aug 11, 2025
CVE-2025-8835
A vulnerability was found in JasPer up to 4.2.5
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c of the component Image Color Space Conversion Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
Jasper · Jasper Project
through 4.2.5 · source: NVD
Affected product
JA
Jasper
Jasper Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8835
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8835
Exploit
https://drive.google.com/file/d/1E754R-FsFkNJp9OYtu6Dqjv47uGSVP18/view?usp=sharing
Patch
https://github.com/jasper-software/jasper/commit/bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52
Exploit
https://github.com/jasper-software/jasper/issues/400
Exploit
https://github.com/jasper-software/jasper/issues/400#issuecomment-3134702772
Permissions Required
https://vuldb.com/?ctiid.319369
Third Party Advisory
https://vuldb.com/?id.319369
More from Jasper
8.8
CVE-2015-8751
Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integer…
8.8
CVE-2018-19540
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21,…
8.8
CVE-2018-19541
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21,…
7.8
CVE-2025-8837
A vulnerability was identified in JasPer up to 4.2.5
7.8
CVE-2023-51257
An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code