CVE-2025-8836 is a medium-severity vulnerability affecting the JasPer library versions 4.2.0 through 4.2.5. JasPer is an open-source implementation of the JPEG-2000 codec, widely used for encoding and decoding JPEG-2000 images. The vulnerability resides in the function jpc_floorlog2 within the JPEG2000 encoder component (src/libjasper/jpc/jpc_enc.c). Specifically, the issue is a reachable assertion triggered by crafted input that leads to an assertion failure during the encoding process. This assertion failure can cause the application using JasPer to terminate unexpectedly, resulting in a denial of service (DoS). The vulnerability requires local access with low privileges (PR:L) and does not require user interaction (UI:N). The attack complexity is low (AC:L), and no authentication is needed beyond local access. The vulnerability does not impact confidentiality, integrity, or availability beyond the local denial of service. The exploit has been publicly disclosed, but no known exploits are currently observed in the wild. A patch identified by commit 79185d32d7a444abae441935b20ae4676b3513d4 addresses the issue, and applying this patch is recommended to mitigate the vulnerability. The CVSS 4.0 base score is 4.8, reflecting a medium severity level due to the local attack vector and limited impact scope.

For European organizations, the primary impact of CVE-2025-8836 is the potential for local denial of service on systems utilizing the vulnerable JasPer versions for JPEG-2000 image encoding. This could disrupt services or applications that rely on image processing, particularly in sectors such as digital media, publishing, healthcare imaging, and geospatial analysis where JPEG-2000 is more commonly used. Since exploitation requires local access, the threat is more relevant in environments where untrusted users have local system access or where multi-user systems are in place. The vulnerability does not allow remote code execution or data compromise, limiting its impact on confidentiality and integrity. However, denial of service could affect availability of critical image processing workflows, potentially delaying operations or causing system instability. Organizations with automated image processing pipelines or embedded systems using JasPer should be particularly vigilant. Given the public disclosure of the exploit, there is a risk of increased attempts to leverage this vulnerability in targeted attacks or insider threat scenarios.

European organizations should prioritize patching affected JasPer versions by applying the official patch identified by commit 79185d32d7a444abae441935b20ae4676b3513d4 or upgrading to a fixed version beyond 4.2.5. Since the vulnerability requires local access, organizations should enforce strict access controls and limit local user privileges to trusted personnel only. Implementing application whitelisting and monitoring for abnormal termination of image processing applications can help detect exploitation attempts. For environments where JasPer is embedded in third-party software, coordinate with vendors to ensure timely updates. Additionally, conduct audits to identify all systems using JasPer and verify version levels. Employ host-based intrusion detection systems (HIDS) to monitor for suspicious local activity related to image encoding processes. Finally, educate system administrators and users about the risks of local exploitation and the importance of applying patches promptly.