Every CVE Search/ Get API key

CVE-2025-8837

JasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after free

4.8 MediumFix available

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.26%Up 0.2 points since Aug 11, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.8

JasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after free

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Record
CVE-2025-8837
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 2.0
4.3 AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-416, CWE-119
Updated
2026-11-02
EUVDEUVD-2025-24131 4.8

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Record
EUVD-2025-24131
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-p7cc-89mg-9wr6 1.9

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of...

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Record
GHSA-p7cc-89mg-9wr6
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-119, CWE-416
Updated
2026-11-02
NVD 1.9

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Record
CVE-2025-8837
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.3 MediumAV:L/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-119, CWE-416
Updated
2026-11-02
OSV 1.9

JasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after free

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Record
CVE-2025-8837
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-416
Updated
2026-11-02
OSVOESA-2026-4179 7.8

jasper security update

The JasPer Project is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard.

Security Fix(es):

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.(CVE-2025-8837)

Record
OESA-2026-4179
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 14 moreShow less
OSVOESA-2026-4180 7.8

jasper security update

The JasPer Project is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard.

Security Fix(es):

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.(CVE-2025-8837)

Record
OESA-2026-4180
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-4181 7.8

jasper security update

The JasPer Project is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard.

Security Fix(es):

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.(CVE-2025-8837)

Record
OESA-2026-4181
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-8837 1.9

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Record
UBUNTU-CVE-2025-8837
CVSS 4.0
1.9 LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
5.3 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVAZL-66168 No score

CVE-2025-8837 affecting package jasper for versions less than 4.2.1-3

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Record
AZL-66168
Updated
2026-11-05
OSVAZL-66198 No score

CVE-2025-8837 affecting package jasper for versions less than 2.0.32-5

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Record
AZL-66198
Updated
2026-11-02
OSVCLSA-2025-1759498325 No score

jasper: Fix of CVE-2025-8837

  • CVE-2025-8837: fix use after free vulnerability in jpc_dec_dump function
Record
CLSA-2025-1759498325
Updated
2026-11-02
OSVCLSA-2025-1759864646 No score

jasper: Fix of CVE-2025-8837

  • CVE-2025-8837: fix use-after-free vulnerability in jpc_dec_dump()
Record
CLSA-2025-1759864646
Updated
2026-11-02
OSVCLSA-2025-1760026282 No score

jasper: Fix of CVE-2025-8837

  • CVE-2025-8837: fix use-after-free vulnerability in jpc_dec_dump()
Record
CLSA-2025-1760026282
Updated
2026-11-02
OSVopenSUSE-SU-2025:15447-1 No score

jasper-4.2.8-2.1 on GA media

These are all security issues fixed in the jasper-4.2.8-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15447-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20138-1 No score

Security update for jasper

This update for jasper fixes the following issues:

Update to 4.2.8:

  • CVE-2025-8837: Fixed a bug in the JPC decoder that could cause bad memory accesses if the debug level is set sufficiently high (bsc#1247901).
  • CVE-2025-8836: Added some missing range checking on several coding parameters in the JPC encoder (bsc#1247902).
  • CVE-2025-8835: Added a check for a missing color component in the jas_image_chclrspc function (bsc#1247904).
Record
openSUSE-SU-2026:20138-1
Updated
2026-11-02
OSVSUSE-SU-2025:03219-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • CVE-2025-8835: missing range check in the JPEG-2000 (JPC) Encoder leads to assertion failure and crash when processing a malformed JPEG2000 image with an invalid cblkwidth parameter (bsc#1247904).
  • CVE-2025-8836: out-of-bounds array indexing in function jas_image_chclrspc leads to crash when processing a malformed image file with BMP output format and color space conversion (bsc#1247902).
  • CVE-2025-8837: missing operations in cleanup code of the JPEG-2000 (JPC) Encoder leads to use-after-free when processing malformed JPEG2000 images with certain debug levels enabled (bsc#1247901).
Record
SUSE-SU-2025:03219-1
Updated
2026-11-02
OSVSUSE-SU-2025:03367-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • CVE-2025-8835: missing range check in the JPEG-2000 (JPC) Encoder leads to assertion failure and crash when processing a malformed JPEG2000 image with an invalid cblkwidth parameter (bsc#1247904).
  • CVE-2025-8836: out-of-bounds array indexing in function jas_image_chclrspc leads to crash when processing a malformed image file with BMP output format and color space conversion (bsc#1247902).
  • CVE-2025-8837: missing operations in cleanup code of the JPEG-2000 (JPC) Encoder leads to use-after-free when processing malformed JPEG2000 images with certain debug levels enabled (bsc#1247901).
Record
SUSE-SU-2025:03367-1
Updated
2026-11-02
OSVSUSE-SU-2025:3947-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • Update to 4.2.8:

  • CVE-2025-8837: Fixed a bug in the JPC decoder that could cause bad memory accesses if the debug level is set sufficiently high (bsc#1247901).

  • CVE-2025-8836: Added some missing range checking on several coding parameters in the JPC encoder (bsc#1247902).

  • CVE-2025-8835: Added a check for a missing color component in the jas_image_chclrspc function (bsc#1247904).

  • CVE-2023-51257: Fixed invalid memory write bug (bsc#1218802).

Record
SUSE-SU-2025:3947-1
Updated
2026-11-02
OSVSUSE-SU-2026:20200-1 No score

Security update for jasper

This update for jasper fixes the following issues:

Update to 4.2.8:

  • CVE-2025-8837: Fixed a bug in the JPC decoder that could cause bad memory accesses if the debug level is set sufficiently high (bsc#1247901).
  • CVE-2025-8836: Added some missing range checking on several coding parameters in the JPC encoder (bsc#1247902).
  • CVE-2025-8835: Added a check for a missing color component in the jas_image_chclrspc function (bsc#1247904).
Record
SUSE-SU-2026:20200-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jasper
Azure Linux:3
 before 4.2.1-3
4.2.1-3
jasper
Azure Linux:2
 before 2.0.32-5
2.0.32-5
jasper
TuxCare:AlmaLinux:9.2
 before 2.0.28-3.el9.tuxcare.els2
2.0.28-3.el9.tuxcare.els2
jasper-devel
TuxCare:AlmaLinux:9.2
 before 2.0.28-3.el9.tuxcare.els2
2.0.28-3.el9.tuxcare.els2
jasper-libs
TuxCare:AlmaLinux:9.2
 before 2.0.28-3.el9.tuxcare.els2
2.0.28-3.el9.tuxcare.els2
jasper-utils
TuxCare:AlmaLinux:9.2
 before 2.0.28-3.el9.tuxcare.els2
2.0.28-3.el9.tuxcare.els2
jasper
TuxCare:CentOS:7
 before 1.900.1-33.el7.tuxcare.els2
1.900.1-33.el7.tuxcare.els2
jasper-devel
TuxCare:CentOS:7
 before 1.900.1-33.el7.tuxcare.els2
1.900.1-33.el7.tuxcare.els2
jasper-libs
TuxCare:CentOS:7
 before 1.900.1-33.el7.tuxcare.els2
1.900.1-33.el7.tuxcare.els2
jasper-utils
TuxCare:CentOS:7
 before 1.900.1-33.el7.tuxcare.els2
1.900.1-33.el7.tuxcare.els2
Show 18 moreShow less
Affected packages
PackageAffectedFixed
jasper
TuxCare:OracleLinux:7
 before 1.900.1-33.el7.tuxcare.els2
1.900.1-33.el7.tuxcare.els2
jasper-devel
TuxCare:OracleLinux:7
 before 1.900.1-33.el7.tuxcare.els2
1.900.1-33.el7.tuxcare.els2
jasper-libs
TuxCare:OracleLinux:7
 before 1.900.1-33.el7.tuxcare.els2
1.900.1-33.el7.tuxcare.els2
jasper-utils
TuxCare:OracleLinux:7
 before 1.900.1-33.el7.tuxcare.els2
1.900.1-33.el7.tuxcare.els2
jasper
openEuler:24.03-LTS-SP1
 before 4.1.0-5.oe2403sp1
4.1.0-5.oe2403sp1
jasper
openEuler:24.03-LTS-SP3
 before 4.1.0-5.oe2403sp3
4.1.0-5.oe2403sp3
jasper
openEuler:24.03-LTS-SP4
 before 4.1.0-5.oe2403sp4
4.1.0-5.oe2403sp4
jasper
SUSE:Linux Enterprise Module for Basesystem 15 SP6
From an advisory covering 3 CVEs
 before 2.0.14-150000.3.37.1
2.0.14-150000.3.37.1
jasper
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 2.0.14-150000.3.37.1
2.0.14-150000.3.37.1
jasper
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 3 CVEs
 before 1.900.14-195.43.1
1.900.14-195.43.1
jasper
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
From an advisory covering 4 CVEs
 before 4.2.8-150600.4.5.1
4.2.8-150600.4.5.1
jasper
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 4 CVEs
 before 4.2.8-150600.4.5.1
4.2.8-150600.4.5.1
jasper
openSUSE:Leap 15.6
From an advisory covering 4 CVEs
 before 4.2.8-150600.4.5.1
4.2.8-150600.4.5.1
jasper
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 4.2.8-160000.1.1
4.2.8-160000.1.1
jasper
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 4.2.8-160000.1.1
4.2.8-160000.1.1
jasper
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.21.900.1-debian1-2.4ubuntu1.3
 None known
jasper
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 4.2.8-2.1
4.2.8-2.1
jasper
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 4.2.8-160000.1.1
4.2.8-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-8837 is a medium vulnerability (CVSS 4.8) in Jasper Project Jasper, published August 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in jasper 4.2.1-3.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open