Low severity · published Aug 11, 2025
CVE-2025-8836
JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JA
JasPer ·
4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8836
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8836
Exploit
https://drive.google.com/file/d/1pPgndhHh2z0lk99Wt31W-XIW3XWt8FB3/view?usp=drive_link
Patch
https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4
Exploit
https://github.com/jasper-software/jasper/issues/401
Permissions Required
https://vuldb.com/?ctiid.319370
Third Party Advisory
https://vuldb.com/?id.319370
Exploit
https://vuldb.com/?submit.622409
More from JasPer
7.8
CVE-2025-8837
JasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after free
7.5
CVE-2022-2963
A vulnerability found in jasper
5.5
CVE-2025-8835
JasPer Image Color Space Conversion jas_image.c jas_image_chclrspc null pointer dereference