---
id: CVE-2018-19541
title: >-
  An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11,
  1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18,
  1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25,
  1.900.26, 1.900.27, 1.900…
summary: >-
  An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11,
  1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18,
  1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25,
  1.900.26, 1.900.27, 1.900…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
vendor: jasper_project
product: jasper
affected:
  - jasper = 2.0.14
  - ubuntu_linux = 14.04
  - ubuntu_linux = 16.04
  - linux_enterprise_desktop = 12
  - linux_enterprise_server = 11
  - linux_enterprise_server = 12
  - debian_linux = 8.0
published: '2018-11-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T18:17:17.440'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-19541'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00023.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00025.html'
    label: cve@mitre.org
  - url: 'https://github.com/mdadams/jasper/issues/182'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html'
    label: cve@mitre.org
  - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00023.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00025.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/mdadams/jasper/issues/182'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T17:39:34.343075Z'
epss: 0.02802
epssPercentile: 0.8623
ingestedAt: '2026-10-15T18:23:58.398Z'
---

## Overview

An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.

## Affected

- `jasper = 2.0.14`
- `ubuntu_linux = 14.04`
- `ubuntu_linux = 16.04`
- `linux_enterprise_desktop = 12`
- `linux_enterprise_server = 11`
- `linux_enterprise_server = 12`
- `debian_linux = 8.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.