CVE-2018-20570: jp2_encode in jp2/jp2_enc.c in JasPer 2.0.14 has a heap-based buffer over-read.

Security readout for executives and security teams

CVE-2018-20570 is a heap-based buffer over-read in JasPer 2.0.14 during JP2 encoding. In business terms, systems that process JPEG 2000 content with affected JasPer builds may be exposed to reliability or memory-safety risk from crafted input. The provided sources do not include a CVSS score or active exploitation evidence. Exposure is most likely where JasPer 2.0.14, or vendor packages derived from it, are used to encode or handle JP2/JPEG 2000 files. Servers, desktop image workflows, document pipelines, and bundled third-party components may be relevant if they include JasPer. Treat this as a targeted dependency remediation item, not an emergency, unless business-critical systems process untrusted JP2/JPEG 2000 content. The lack of CVSS and exploitation evidence lowers urgency, but vendor advisories justify patch tracking. Mitigation focus: Inventory systems and applications that include JasPer or process JP2/JPEG 2000 files.; Apply vendor security updates from the relevant operating system or product provider.; Check Debian, openSUSE, Oracle, and upstream JasPer guidance for fixed package versions..

Prepared

Jun 6, 2026, 22:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.