CVE-2025-8836

LOW EPSS 8.4%
Published Aug 11, 202510mo ago · Modified Jun 17, 20261w ago
1.9 CVSS 4.0
Low
Find Similar
Published Aug 11, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

CVSS Details

Base Score
1.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
8.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-617

Affected Products 1

VendorProductVersionRange
jasper_projectjasper* ≤4.2.5

References 6

  • drive.google.com https://drive.google.com/file/d/1pPgndhHh2z0lk99Wt31W-XIW3XWt8FB3/view?usp=drive_link
    Exploit
  • github.com https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4
    Patch
  • github.com https://github.com/jasper-software/jasper/issues/401
    ExploitIssue TrackingVendor Advisory
  • vuldb.com https://vuldb.com/?ctiid.319370
    Permissions RequiredVDB Entry
  • vuldb.com https://vuldb.com/?id.319370
    Third Party AdvisoryVDB Entry
  • vuldb.com https://vuldb.com/?submit.622409
    ExploitThird Party AdvisoryVDB Entry

Remediation

  • github.com https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4
    Patch