CVE-2014-9029: Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/...

Security readout for executives and security teams

CVE-2014-9029 is a memory corruption flaw in JasPer, a library used to handle JPEG-2000/JP2 images. A malicious JP2 file could trigger a heap buffer overflow and allow arbitrary code execution in software that processes it. Exposure is most likely where JasPer 1.900.1 or earlier, or downstream packages linked to it, process untrusted JP2/JPEG-2000 files. Servers, desktop tools, converters, and automated media pipelines are higher concern if they accept user-supplied images. Treat this as a patching and exposure-reduction item for systems that process untrusted images. Business urgency is higher for public upload services and automated media pipelines, lower where JP2 files are not accepted or JasPer is absent. Mitigation focus: Identify all JasPer packages and statically linked copies in supported environments.; Update JasPer through the operating system or application vendor guidance.; Restrict processing of untrusted JP2/JPEG-2000 files until patched..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.