PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-8882 Jasper Project CVE debrief

CVE-2016-8882 is a denial-of-service issue in JasPer’s JPEG-2000 decoder path. The affected function, jpc_dec_tilefini in libjasper/jpc/jpc_dec.c, can hit a NULL pointer dereference and crash when processing a crafted file. The CVE record lists JasPer versions before 1.900.8 as vulnerable. NVD assigns medium severity and a CVSS 3.0 vector that reflects availability impact with user interaction required.

Vendor
Jasper Project
Product
Jasper
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-13
Original CVE updated
2026-05-13
Advisory published
2017-01-13
Advisory updated
2026-05-13

Who should care

Administrators, package maintainers, and application teams that ship or embed JasPer and process untrusted image files, especially JPEG-2000 content.

Technical summary

The vulnerability is a NULL pointer dereference in jpc_dec_tilefini during decoder tile cleanup. The supplied CVE description says a crafted file can trigger the crash remotely, while NVD’s CVSS vector describes local access with user interaction required. The affected version range in the record is JasPer before 1.900.8.

Defensive priority

Medium. This is an availability-only issue, but it can still disrupt services that parse untrusted files. Prioritize patching where JasPer is exposed to external content or used in automated processing pipelines.

Recommended defensive actions

  • Upgrade JasPer to 1.900.8 or later.
  • Inventory systems and applications that bundle or depend on JasPer.
  • Treat untrusted JPEG-2000 files as risky input and restrict where they can be processed.
  • Rebuild downstream packages after upgrading the library.
  • If immediate upgrading is not possible, reduce exposure by limiting file ingestion paths to trusted sources only.

Evidence notes

Based on the supplied CVE description, the vulnerable function is jpc_dec_tilefini in libjasper/jpc/jpc_dec.c, with a NULL pointer dereference and crash triggered by a crafted file. The supplied NVD data lists JasPer versions up to 1.900.7 as vulnerable and classifies the issue as CWE-476. The CVSS vector is CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. No KEV entry or ransomware association is present in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-8882 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-8882

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-8882 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-8882

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.