CVE-2025-8835
BaseFortify
Publication date: 2025-08-11
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jasper_project | jasper | to 4.2.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-8835 is a null pointer dereference vulnerability in the JasPer image processing library (up to version 4.2.5). It occurs in the function jas_image_chclrspc, which handles image color space conversion. When processing a malformed image file with certain command-line options (such as outputting BMP format), the image loading function fails and returns a NULL pointer. This NULL pointer is then passed unchecked to jas_image_chclrspc, which attempts to dereference it, causing the application to crash with a segmentation fault (SIGSEGV). The vulnerability requires local access to exploit and can lead to denial of service by crashing the application. [1, 2, 4]
How can this vulnerability impact me? :
This vulnerability can cause the JasPer image processing application to crash when it processes specially crafted malformed image files. The crash results from a null pointer dereference in the color space conversion function, leading to a denial of service (DoS) condition. An attacker with local access can exploit this to disrupt availability of services or applications relying on JasPer for image processing. There is a publicly available proof-of-concept exploit demonstrating this crash. [1, 2, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to reproduce the crash using the JasPer command-line tool with a specially crafted malformed image file that triggers the null pointer dereference. A known command to test this is: ./jasper --output-format bmp --cmptno ppm -S --input POC_jasper_null_pointer_dereference Running this command with the provided malformed image file (POC) causes the application to crash with a segmentation fault (SIGSEGV) at the jas_image_chclrspc function. Monitoring for such crashes or segmentation faults when processing images with JasPer can help detect exploitation attempts or presence of the vulnerability. [2, 4]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the patch identified by commit bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52, which adds robust validation checks in the jas_image_chclrspc function to prevent null pointer dereferences. Until the patch is applied, avoid processing untrusted or malformed image files with JasPer, especially using command-line options that trigger color space conversion and BMP output format. Monitoring and restricting local access to the vulnerable JasPer versions can also reduce risk. [1, 3]