CVE-2025-8836

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-8836", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-08-10T11:14:50.565Z", "datePublished": "2025-08-11T07:32:08.430Z", "dateUpdated": "2025-08-12T13:44:11.473Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-08-11T07:32:08.430Z"}, "title": "JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-617", "lang": "en", "description": "Reachable Assertion"}]}], "affected": [{"vendor": "n/a", "product": "JasPer", "versions": [{"version": "4.2.0", "status": "affected"}, {"version": "4.2.1", "status": "affected"}, {"version": "4.2.2", "status": "affected"}, {"version": "4.2.3", "status": "affected"}, {"version": "4.2.4", "status": "affected"}, {"version": "4.2.5", "status": "affected"}], "modules": ["JPEG2000 Encoder"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue."}, {"lang": "de", "value": "Davon betroffen ist die Funktion jpc_floorlog2 der Datei src/libjasper/jpc/jpc_enc.c der Komponente JPEG2000 Encoder. Durch das Manipulieren mit unbekannten Daten kann eine reachable assertion-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als 79185d32d7a444abae441935b20ae4676b3513d4 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2025-08-10T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-08-10T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-08-10T13:20:00.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "nipc-cxd (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.319370", "name": "VDB-319370 | JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.319370", "name": "VDB-319370 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.622409", "name": "Submit #622409 | JasPer The newest master && jasper-4.2.5 Assertion Failure", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jasper-software/jasper/issues/401", "tags": ["issue-tracking"]}, {"url": "https://drive.google.com/file/d/1pPgndhHh2z0lk99Wt31W-XIW3XWt8FB3/view?usp=drive_link", "tags": ["exploit"]}, {"url": "https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4", "tags": ["patch"]}]}, "adp": [{"references": [{"url": "https://github.com/jasper-software/jasper/issues/401", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-11T15:14:46.001573Z", "id": "CVE-2025-8836", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-12T13:44:11.473Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8836", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-11T15:14:46.001573Z"}}}], "references": [{"url": "https://github.com/jasper-software/jasper/issues/401", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-11T15:14:47.599Z"}}], "cna": {"title": "JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion", "credits": [{"lang": "en", "type": "reporter", "value": "nipc-cxd (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "n/a", "modules": ["JPEG2000 Encoder"], "product": "JasPer", "versions": [{"status": "affected", "version": "4.2.0"}, {"status": "affected", "version": "4.2.1"}, {"status": "affected", "version": "4.2.2"}, {"status": "affected", "version": "4.2.3"}, {"status": "affected", "version": "4.2.4"}, {"status": "affected", "version": "4.2.5"}]}], "timeline": [{"lang": "en", "time": "2025-08-10T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-08-10T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-08-10T13:20:00.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.319370", "name": "VDB-319370 | JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.319370", "name": "VDB-319370 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.622409", "name": "Submit #622409 | JasPer The newest master && jasper-4.2.5 Assertion Failure", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jasper-software/jasper/issues/401", "tags": ["issue-tracking"]}, {"url": "https://drive.google.com/file/d/1pPgndhHh2z0lk99Wt31W-XIW3XWt8FB3/view?usp=drive_link", "tags": ["exploit"]}, {"url": "https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue."}, {"lang": "de", "value": "Davon betroffen ist die Funktion jpc_floorlog2 der Datei src/libjasper/jpc/jpc_enc.c der Komponente JPEG2000 Encoder. Durch das Manipulieren mit unbekannten Daten kann eine reachable assertion-Schwachstelle ausgenutzt werden. Der Angriff muss lokal passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als 79185d32d7a444abae441935b20ae4676b3513d4 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "Reachable Assertion"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-08-11T07:32:08.430Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8836", "state": "PUBLISHED", "dateUpdated": "2025-08-12T13:44:11.473Z", "dateReserved": "2025-08-10T11:14:50.565Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-08-11T07:32:08.430Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["JPEG2000 Encoder"], "product": "JasPer", "vendor": "n/a", "versions": [{"status": "affected", "version": "4.2.0"}, {"status": "affected", "version": "4.2.1"}, {"status": "affected", "version": "4.2.2"}, {"status": "affected", "version": "4.2.3"}, {"status": "affected", "version": "4.2.4"}, {"status": "affected", "version": "4.2.5"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jasper_project:jasper:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FE39B51-8944-431F-B8E4-7D8783772137", "versionEndIncluding": "4.2.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en JasPer hasta la versi\u00f3n 4.2.5. Este problema afecta a la funci\u00f3n jpc_floorlog2 del archivo src/libjasper/jpc/jpc_enc.c del componente JPEG2000 Encoder. La manipulaci\u00f3n genera una aserci\u00f3n accesible. El ataque debe abordarse localmente. Se ha hecho p\u00fablico el exploit y puede que sea utilizado. El parche se identifica como 79185d32d7a444abae441935b20ae4676b3513d4. Se recomienda aplicar un parche para solucionar este problema."}], "id": "CVE-2025-8836", "lastModified": "2026-06-17T10:07:45.143", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 1.7, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8836", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-11T15:14:46.001573Z", "version": "2.0.3"}}]}, "published": "2025-08-11T08:15:26.700", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit"], "url": "https://drive.google.com/file/d/1pPgndhHh2z0lk99Wt31W-XIW3XWt8FB3/view?usp=drive_link"}, {"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/jasper-software/jasper/commit/79185d32d7a444abae441935b20ae4676b3513d4"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/jasper-software/jasper/issues/401"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.319370"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.319370"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.622409"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/jasper-software/jasper/issues/401"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-08-12T11:47:06.710128+00:00", "updated": "2025-08-12T11:47:06.710179+00:00", "vendors": ["jasper_project", "jasper_project$PRODUCT$jasper"]}