CVE-2025-8837

Publication date 11 August 2025

Last updated 13 August 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

5.3 · Medium

Score breakdown

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

Why is this CVE low priority?

localhost access is needed

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
jasper 25.04 plucky Not in release
24.04 LTS noble Not in release
22.04 LTS jammy Not in release
16.04 LTS xenial
Needs evaluation

Severity score breakdown

Parameter Value
Base score 5.3 · Medium
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality Low
Integrity impact Low
Availability impact Low
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L