Every CVE Search/ Get API key

CVE-2025-8836

JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion

4.8 MediumFix available

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.23%Up 0.2 points since Aug 11, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.8

JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Record
CVE-2025-8836
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 3.0
3.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CVSS 2.0
1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-617
Updated
2026-11-02
EUVDEUVD-2025-24133 4.8

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Record
EUVD-2025-24133
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-hvcg-67f3-52cf 1.9

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function...

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Record
GHSA-hvcg-67f3-52cf
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-617
Updated
2026-11-02
NVD 1.9

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Record
CVE-2025-8836
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
1.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P
Weakness
CWE-617
Updated
2026-11-02
OSV 1.9

JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Record
CVE-2025-8836
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-617
Updated
2026-11-02
OSVUBUNTU-CVE-2025-8836 1.9

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Record
UBUNTU-CVE-2025-8836
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 11 moreShow less
OSVAZL-66165 No score

CVE-2025-8836 affecting package jasper for versions less than 4.2.1-3

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Record
AZL-66165
Updated
2026-11-05
OSVAZL-66201 No score

CVE-2025-8836 affecting package jasper for versions less than 2.0.32-5

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Record
AZL-66201
Updated
2026-11-02
OSVCLSA-2025-1760019942 No score

jasper: Fix of CVE-2025-8836

  • CVE-2025-8836: fix manipulation in function jpc_floorlog2 to prevent reachable assertion
Record
CLSA-2025-1760019942
Updated
2026-11-02
OSVCLSA-2025-1761074965 No score

jasper: Fix of CVE-2025-8836

  • CVE-2025-8836: fix manipulation in function jpc_floorlog2 to prevent reachable assertion
Record
CLSA-2025-1761074965
Updated
2026-11-02
OSVCLSA-2025-1765378381 No score

jasper: Fix of 3 CVEs

  • CVE-2025-8836: fix manipulation in function jpc_floorlog2 to prevent reachable assertion
Record
CLSA-2025-1765378381
Updated
2026-11-02
OSVopenSUSE-SU-2025:15447-1 No score

jasper-4.2.8-2.1 on GA media

These are all security issues fixed in the jasper-4.2.8-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15447-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20138-1 No score

Security update for jasper

This update for jasper fixes the following issues:

Update to 4.2.8:

  • CVE-2025-8837: Fixed a bug in the JPC decoder that could cause bad memory accesses if the debug level is set sufficiently high (bsc#1247901).
  • CVE-2025-8836: Added some missing range checking on several coding parameters in the JPC encoder (bsc#1247902).
  • CVE-2025-8835: Added a check for a missing color component in the jas_image_chclrspc function (bsc#1247904).
Record
openSUSE-SU-2026:20138-1
Updated
2026-11-02
OSVSUSE-SU-2025:03219-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • CVE-2025-8835: missing range check in the JPEG-2000 (JPC) Encoder leads to assertion failure and crash when processing a malformed JPEG2000 image with an invalid cblkwidth parameter (bsc#1247904).
  • CVE-2025-8836: out-of-bounds array indexing in function jas_image_chclrspc leads to crash when processing a malformed image file with BMP output format and color space conversion (bsc#1247902).
  • CVE-2025-8837: missing operations in cleanup code of the JPEG-2000 (JPC) Encoder leads to use-after-free when processing malformed JPEG2000 images with certain debug levels enabled (bsc#1247901).
Record
SUSE-SU-2025:03219-1
Updated
2026-11-02
OSVSUSE-SU-2025:03367-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • CVE-2025-8835: missing range check in the JPEG-2000 (JPC) Encoder leads to assertion failure and crash when processing a malformed JPEG2000 image with an invalid cblkwidth parameter (bsc#1247904).
  • CVE-2025-8836: out-of-bounds array indexing in function jas_image_chclrspc leads to crash when processing a malformed image file with BMP output format and color space conversion (bsc#1247902).
  • CVE-2025-8837: missing operations in cleanup code of the JPEG-2000 (JPC) Encoder leads to use-after-free when processing malformed JPEG2000 images with certain debug levels enabled (bsc#1247901).
Record
SUSE-SU-2025:03367-1
Updated
2026-11-02
OSVSUSE-SU-2025:3947-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • Update to 4.2.8:

  • CVE-2025-8837: Fixed a bug in the JPC decoder that could cause bad memory accesses if the debug level is set sufficiently high (bsc#1247901).

  • CVE-2025-8836: Added some missing range checking on several coding parameters in the JPC encoder (bsc#1247902).

  • CVE-2025-8835: Added a check for a missing color component in the jas_image_chclrspc function (bsc#1247904).

  • CVE-2023-51257: Fixed invalid memory write bug (bsc#1218802).

Record
SUSE-SU-2025:3947-1
Updated
2026-11-02
OSVSUSE-SU-2026:20200-1 No score

Security update for jasper

This update for jasper fixes the following issues:

Update to 4.2.8:

  • CVE-2025-8837: Fixed a bug in the JPC decoder that could cause bad memory accesses if the debug level is set sufficiently high (bsc#1247901).
  • CVE-2025-8836: Added some missing range checking on several coding parameters in the JPC encoder (bsc#1247902).
  • CVE-2025-8835: Added a check for a missing color component in the jas_image_chclrspc function (bsc#1247904).
Record
SUSE-SU-2026:20200-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jasper
Azure Linux:3
 before 4.2.1-3
4.2.1-3
jasper
Azure Linux:2
 before 2.0.32-5
2.0.32-5
jasper
TuxCare:AlmaLinux:9.2
 before 2.0.28-3.el9.tuxcare.els4
2.0.28-3.el9.tuxcare.els4
jasper-devel
TuxCare:AlmaLinux:9.2
 before 2.0.28-3.el9.tuxcare.els4
2.0.28-3.el9.tuxcare.els4
jasper-libs
TuxCare:AlmaLinux:9.2
 before 2.0.28-3.el9.tuxcare.els4
2.0.28-3.el9.tuxcare.els4
jasper-utils
TuxCare:AlmaLinux:9.2
 before 2.0.28-3.el9.tuxcare.els4
2.0.28-3.el9.tuxcare.els4
jasper
TuxCare:CentOS:7
 before 1.900.1-33.el7.tuxcare.els4
1.900.1-33.el7.tuxcare.els4
jasper-devel
TuxCare:CentOS:7
 before 1.900.1-33.el7.tuxcare.els4
1.900.1-33.el7.tuxcare.els4
jasper-libs
TuxCare:CentOS:7
 before 1.900.1-33.el7.tuxcare.els4
1.900.1-33.el7.tuxcare.els4
jasper-utils
TuxCare:CentOS:7
 before 1.900.1-33.el7.tuxcare.els4
1.900.1-33.el7.tuxcare.els4
Show 15 moreShow less
Affected packages
PackageAffectedFixed
jasper
TuxCare:AlmaLinux:9.6
 before 2.0.28-3.el9.tuxcare.els4
2.0.28-3.el9.tuxcare.els4
jasper-devel
TuxCare:AlmaLinux:9.6
 before 2.0.28-3.el9.tuxcare.els4
2.0.28-3.el9.tuxcare.els4
jasper-libs
TuxCare:AlmaLinux:9.6
 before 2.0.28-3.el9.tuxcare.els4
2.0.28-3.el9.tuxcare.els4
jasper-utils
TuxCare:AlmaLinux:9.6
 before 2.0.28-3.el9.tuxcare.els4
2.0.28-3.el9.tuxcare.els4
jasper
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 3 CVEs
 before 2.0.14-150000.3.37.1
2.0.14-150000.3.37.1
jasper
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 2.0.14-150000.3.37.1
2.0.14-150000.3.37.1
jasper
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 3 CVEs
 before 1.900.14-195.43.1
1.900.14-195.43.1
jasper
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
From an advisory covering 4 CVEs
 before 4.2.8-150600.4.5.1
4.2.8-150600.4.5.1
jasper
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 4 CVEs
 before 4.2.8-150600.4.5.1
4.2.8-150600.4.5.1
jasper
openSUSE:Leap 15.6
From an advisory covering 4 CVEs
 before 4.2.8-150600.4.5.1
4.2.8-150600.4.5.1
jasper
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 4.2.8-160000.1.1
4.2.8-160000.1.1
jasper
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 4.2.8-160000.1.1
4.2.8-160000.1.1
jasper
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.21.900.1-debian1-2.4ubuntu1.3
 None known
jasper
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 4.2.8-2.1
4.2.8-2.1
jasper
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 4.2.8-160000.1.1
4.2.8-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-8836 is a medium vulnerability (CVSS 4.8) in Jasper Project Jasper, published August 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in jasper 4.2.1-3.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open