CVE-2025-8836

Name of the Vulnerable Software and Affected Versions: JasPer versions up to 4.2.5

Description: A vulnerability exists in JasPer up to version 4.2.5, specifically within the JPEG2000 Encoder component. The issue resides in the jpc floorlog2 function located in the src/libjasper/jpc/jpc enc.c file. Manipulation of this function can lead to a reachable assertion. The attack requires local access. The exploit for this issue has been publicly disclosed and may be utilized.

Recommendations: JasPer versions prior to 4.2.5: Apply the patch identified as 79185d32d7a444abae441935b20ae4676b3513d4 to resolve this issue.