CVE-2016-9399: The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of ser...

Security readout for executives and security teams

CVE-2016-9399 is a denial-of-service issue in JasPer 1.900.22, an image processing library. A crafted, unspecified input can trigger an assertion failure in JPEG-2000 decoding code, crashing the affected process. The source bundle does not show data theft, code execution, CVSS scoring, or confirmed active exploitation. Exposure is most likely where JasPer 1.900.22, or vulnerable downstream packages, process untrusted image files. Higher-risk placements include upload pipelines, thumbnailers, document converters, security scanners, and media-processing services. The bundle’s affected-product metadata is incomplete, so inventory confirmation is required. Treat this as a service-stability risk, not a confirmed breach path. Prioritize internet-facing or automated image-processing systems first, especially where crashes could disrupt customer workflows or batch processing. The lack of CVSS and incomplete affected metadata mean prioritization should be driven by local exposure. Mitigation focus: Identify systems and applications using JasPer or libjasper packages.; Apply relevant vendor updates from your operating system or package maintainer.; Check upstream and vendor guidance for exact fixed versions..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.