CVE-2025-8836

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
n/a	JasPer	4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5

References

https://drive.google.com/file/d/1pPgndhHh2z0lk99Wt31W-XIW3XWt8FB3/view?usp=drive_linkExploit
https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4Patch
https://github.com/jasper-software/jasper/issues/401Exploit, Issue Tracking, Vendor Advisory
https://vuldb.com/?ctiid.319370Permissions Required, VDB Entry
https://vuldb.com/?id.319370Third Party Advisory, VDB Entry
https://vuldb.com/?submit.622409Exploit, Third Party Advisory, VDB Entry
https://github.com/jasper-software/jasper/issues/401Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Aug 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-88377.8A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the CVE-2025-88389.8A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the functio CVE-2025-88398.8A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the compo CVE-2025-88405.4A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the compone CVE-2025-88416.1A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the f CVE-2025-88427.8A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected by this issue is the function do_directive of the file preproc.c. CVE-2025-88437.8A vulnerability was found in NASM Netwide Assember 2.17rc0. This affects the function macho_no_dead_strip of the file outmacho.c. The manipu CVE-2025-88445.5A vulnerability was determined in NASM Netwide Assember 2.17rc0. This vulnerability affects the function parse_smacro_template of the file p CVE-2025-88457.8A vulnerability was identified in NASM Netwide Assember 2.17rc0. This issue affects the function assemble_file of the file nasm.c. The manip CVE-2025-88467.8A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected is the function parse_line of the file parser.c. The manipulation CVE-2025-88475.4A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is the function Edit of the file /system/notice CVE-2025-88485.4A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends