CVE-2014-9029: Jasper Project Jasper

High severity, CVSS 7.5. EPSS: 18.4% chance of exploitation in the next 30 days.

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.

Affected products

• Jasper Project Jasper: up to and including 1.900.1

Published 2014-12-08. Last modified 2026-06-17.