CVE-2024-31744: Jasper DoS Vulnerability via Assertion

CVE-2024-31744 Overview

CVE-2024-31744 is a denial-of-service vulnerability in JasPer 4.2.2, an open-source reference implementation of the JPEG-2000 codec. The flaw resides in the jpc_streamlist_remove function within src/libjasper/jpc/jpc_dec.c at line 2407. A specially crafted JPEG-2000 image triggers an assertion failure during decoding, causing the process to abort. The issue is classified as a reachable assertion ([CWE-617]) and can be exploited remotely whenever an application passes attacker-controlled imagery to the vulnerable JasPer routines.

Critical Impact
Remote attackers can crash any application that uses JasPer 4.2.2 to decode JPEG-2000 files by supplying a malformed image, resulting in availability loss for image-processing pipelines and downstream services.

Affected Products

JasPer 4.2.2 (libjasper)
Applications statically or dynamically linking the vulnerable libjasper build
Image-processing pipelines that accept JPEG-2000 (.jp2, .jpc) input

Discovery Timeline

2024-04-19 - CVE-2024-31744 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31744

Vulnerability Analysis

The vulnerability is a reachable assertion in the JPEG-2000 decoder. When JasPer processes a tile-part that references packet-header streams, it calls jpc_streamlist_remove(dec->pkthdrstreams, 0) to pull the next stream. The function asserts that the stream list contains at least one entry. A crafted image can reach this code path while dec->pkthdrstreams is empty, violating the assertion and terminating the process through abort(). The result is an unconditional denial of service against any consumer of the library.

Root Cause

The root cause is missing input validation before calling jpc_streamlist_remove. The decoder dereferences and removes from dec->pkthdrstreams without first verifying that jpc_streamlist_numstreams(dec->pkthdrstreams) is non-zero. When an attacker-controlled marker segment leaves the list empty at the point of removal, the internal assertion fires. The bug is tracked upstream as JasPer issue #381.

Attack Vector

Exploitation requires no authentication or user interaction beyond delivering a malicious JPEG-2000 file to a target that decodes it with JasPer 4.2.2. Likely delivery channels include web upload endpoints, document conversion services, thumbnail generators, and email gateways that parse attachments. The attacker gains no code execution or data disclosure, only loss of availability for the affected process.

// Patch in src/libjasper/jpc/jpc_dec.c - Fixes #381
 if (dec->pkthdrstreams) {
     /* Get the stream containing the packet header data for this
       tile-part. */
-    if (!(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams, 0))) {
+    if (jpc_streamlist_numstreams(dec->pkthdrstreams) != 0 &&
+      !(tile->pkthdrstream = jpc_streamlist_remove(dec->pkthdrstreams,
+      0))) {
         return -1;
     }
 }

Source: JasPer commit 6d084c5. The fix adds a length check via jpc_streamlist_numstreams so the decoder skips the removal when the list is empty instead of triggering the assertion.

Detection Methods for CVE-2024-31744

Indicators of Compromise

Process termination of image-handling services with SIGABRT and an assertion message referencing jpc_dec.c
Repeated short-lived crashes of worker processes shortly after ingesting JPEG-2000 (.jp2, .jpc) attachments or uploads
Spikes in failed image-conversion jobs originating from a small set of source addresses

Detection Strategies

Inventory installed libjasper versions across servers, build images, and container layers; flag any instance reporting 4.2.2
Inspect upload and conversion logs for malformed JPEG-2000 markers and decoder error returns prior to crashes
Correlate web application firewall events for JPEG-2000 uploads with downstream service restarts to surface exploit attempts

Monitoring Recommendations

Alert on abnormal restart rates for image-processing daemons, thumbnailers, and document converters
Capture core dumps from JasPer-linked processes and review stack traces for frames inside jpc_streamlist_remove
Track inbound file types at the gateway and rate-limit or sandbox JPEG-2000 submissions from untrusted sources

How to Mitigate CVE-2024-31744

Immediate Actions Required

Upgrade libjasper to a release containing commit 6d084c53a77762f41bb5310713a5f1872fef55f5 or later
Rebuild and redeploy any application that statically links JasPer 4.2.2
Restrict or disable JPEG-2000 decoding on internet-facing services until patched

Patch Information

The upstream fix is available in the JasPer repository as commit 6d084c5, which guards the call to jpc_streamlist_remove with a jpc_streamlist_numstreams length check. Distributions shipping JasPer 4.2.2 should pick up this commit or move to a later tagged release. Verify that downstream packages (for example, those bundled inside container base images) also incorporate the patched library.

Workarounds

Run image decoders inside isolated, automatically restarted workers so an assertion crash does not affect the parent service
Filter JPEG-2000 uploads at the perimeter when patching cannot be performed immediately
Apply seccomp or sandbox profiles that contain a crashing decoder and prevent restart-loop abuse

bash

# Verify the installed JasPer version and rebuild after upgrading
jasper --version
ldconfig -p | grep libjasper

# Example: rebuild from patched source
git clone https://github.com/jasper-software/jasper.git
cd jasper
git checkout 6d084c53a77762f41bb5310713a5f1872fef55f5
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --target install