CVE-2023-51257 is a high severity (CVSS 7.8) invalid memory write in JasPer 4.1.1 and earlier, triggered while parsing an ICC profile in a JPEG 2000 file. The upstream fix is a December 2023 commit, and the issue notes distributions backporting it. Update to a build that includes it.
What's affected
The NVD description says an invalid memory write in Jasper-Software JasPer v4.1.1 and before allows a local attacker to execute arbitrary code. The upstream issue identifies the function jas_icctxt_input in jas_icc.c, reached when a JPEG 2000 decoder loads an ICC profile. It reports version 4.1.1 and gives no wider affected range.
The upstream issue was closed as completed by commit aeef5293c978158255ad4f127089644745602f2a on 15 December 2023. It does not name a fixed release, and it notes that distributions had started backporting the fix. Fedora package announcements are among the record's references. Check your distribution's advisory for the package version that includes the fix.
CVSS for this entry is 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Find out whether JasPer is installed and which version, and which applications link to it.
rpm -q jasper
dpkg -l | grep -i jasper
The first command suits Fedora and Red Hat family systems, the second Debian and Ubuntu. Then look for software that bundles its own copy of JasPer, such as image tools and some document converters, which a package query will not show. A dependency scan of your applications is the reliable way to find those.
What to do now
- Query packages for JasPer on your hosts with the commands above.
- Install the updated package from your distribution that carries the upstream fix, per its advisory.
- Rebuild or update applications that bundle their own copy of JasPer.
- Do not process untrusted JPEG 2000 files with an unpatched library, for example in upload or thumbnail pipelines.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-119 is improper restriction of operations within the bounds of a memory buffer. The program reads or writes memory outside the area it should touch. The fix is bounds checking at the point where the data is parsed.
CWE-119 is improper restriction of operations within the bounds of a memory buffer. Parsers for rich file formats are a common home for it, because they trust length fields inside the file. The NVD vector is local with low privileges and no interaction, with high impact on all three properties.
Who feeds files to the library decides how serious it is. A desktop viewer is a smaller risk than a server that decodes images from the internet.
The record does not mark exploitation.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which JasPer release fixes it?
The upstream issue does not name one. It points to a commit and to distribution backports, so check your vendor's advisory.
Why is it a local vector?
NVD classed it so because a user opens the file. Server-side pipelines that decode uploads change the picture.
Sources
Last reviewed: 19 October 2026.
