CVE-2025-8836 | THREATINT

Description

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Davon betroffen ist die Funktion jpc_floorlog2 der Datei src/libjasper/jpc/jpc_enc.c der Komponente JPEG2000 Encoder. Durch das Manipulieren mit unbekannten Daten kann eine reachable assertion-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur öffentlichen Verfügung. Der Patch wird als 79185d32d7a444abae441935b20ae4676b3513d4 bezeichnet. Als bestmögliche Massnahme wird Patching empfohlen.

Reserved 2025-08-10 | Published 2025-08-11 | Updated 2025-08-11 | Assigner VulDB

MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

LOW: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

LOW: 3.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

1.7AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C

Problem types

Reachable Assertion

Timeline

2025-08-10:	Advisory disclosed
2025-08-10:	VulDB entry created
2025-08-10:	VulDB entry last update

Credits

nipc-cxd (VulDB User) reporter

References

vuldb.com/?id.319370 (VDB-319370 | JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion) vdb-entry technical-description

vuldb.com/?ctiid.319370 (VDB-319370 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.622409 (Submit #622409 | JasPer The newest master && jasper-4.2.5 Assertion Failure) third-party-advisory

github.com/jasper-software/jasper/issues/401 issue-tracking

drive.google.com/...k99Wt31W-XIW3XWt8FB3/view?usp=drive_link exploit

github.com/...ommit/79185d32d7a444abae441935b20ae4676b3513d4 patch

cve.org (CVE-2025-8836)

nvd.nist.gov (CVE-2025-8836)

Download JSON