CVE-2025-8836 JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion
A local attacker can trigger a reachable assertion in the JasPer JPEG2000 encoder, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-8836?
CVE-2025-8836 is a medium-severity denial of service vulnerability in Jasper Project Jasper, published on 11 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.
Weakness: CWE-617
Which versions are affected by CVE-2025-8836?
It affects 1 product.
Products include Jasper Project Jasper.
How do I fix CVE-2025-8836?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-8836 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8836 exists.
Other vulnerabilities in Jasper Project Jasper
Sources
Also known as AZL-66165, AZL-66201, CLSA-2025-1760019942, CLSA-2025-1761074965, CLSA-2025-1765378381, GHSA-hvcg-67f3-52cf and 1 more.