Vulnerability in Jasper Project
CVE-2025-8836
A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.
EPSS: 0.002 (10.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Jasper_project Jasper
- N/a Jasper — versions 4.2.0, 4.2.1, 4.2.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
- cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry)
- cna@vuldb.com (Exploit, VDB Entry, Third Party Advisory, third-party-advisory)
- cna@vuldb.com (issue-tracking, Exploit, Issue Tracking, Vendor Advisory)
- cna@vuldb.com (Exploit, exploit)
- cna@vuldb.com (Patch, patch)
Frequently asked questions
- What is CVE-2025-8836?
- CVE-2025-8836 is a low-severity vulnerability in Jasper Project, classified under Reachable Assertion. CVSS score: 3.3/10. Published 2025-08-11.
- How severe is CVE-2025-8836?
- Low severity. CVSS v3 base score is 3.3 out of 10.
- Is CVE-2025-8836 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.