CVE-2016-9387: Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 a...

Security readout for executives and security teams

CVE-2016-9387 is a JasPer image-processing flaw fixed before version 1.900.13. A specially crafted file can trigger an integer overflow and assertion failure while parsing JPEG-2000 metadata, potentially crashing software that processes untrusted images. Exposure is most likely where JasPer before 1.900.13 is installed or bundled and used to process untrusted JPEG-2000 or JP2 files, such as upload, conversion, scanning, or preview workflows. Treat this as a patching and exposure-reduction item, not an emergency breach indicator. Prioritize systems that automatically process external image files because crashes can affect service availability. Mitigation focus: Upgrade JasPer to version 1.900.13 or later where applicable.; Apply vendor security updates from Red Hat, Ubuntu, or your OS distributor.; Inventory applications that bundle JasPer rather than using system packages..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.