CVE-2025-8837

CWE-119 — Buffer OverflowCWE-416 — Use After Free6 documents6 sources
Severity
4.8MEDIUM
EPSS
0.1%
top 83.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jasper Project Jasper
Timeline
PublishedAug 11
Latest updateAug 12

Description

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5jasper6 versions+5

Patches

Patch: github.com ↗

🔴Vulnerability Details

3
CVEList
JasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after free↗2025-08-11
▶
OSV
CVE-2025-8837: A vulnerability was identified in JasPer up to 4↗2025-08-11
▶
GHSA
GHSA-p7cc-89mg-9wr6: A vulnerability was identified in JasPer up to 4↗2025-08-11
▶

📋Vendor Advisories

1
Microsoft
JasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after free↗2025-08-12
▶

🕵️Threat Intelligence

1
Threat Intel
UAT-8837
▶