CVE-2024-31744

What it actually does

Assertion failure in jpc_streamlist_remove during JPEG2000 stream list removal in the decoder causes immediate process termination when a crafted image is processed.

Why it matters to the business

Image-handling services and applications may become unavailable after receiving a single malicious file, resulting in downtime and potential loss of processing capability until restarted.

How an attack unfolds

An attacker prepares a JPEG2000 image that exercises an invalid state in the jpc stream list handling code; when the target application decodes the file the assertion triggers and the process exits.

How to fix it

Update jasper-software/jasper to commit 6d084c53a77762f41bb5310713a5f1872fef55f5 or later; rebuild and redeploy all dependent applications.

How to confirm the fix worked

Confirm the running binary or library reports the patched commit; re-process a known triggering image and verify no assertion or crash occurs.

Typical attack path

1. Locate services that accept or process user-supplied images with Jasper
2. Generate or obtain a JPEG2000 file that triggers the assertion in jpc_streamlist_remove
3. Deliver the file to the target (upload, API request, or attachment)
4. Force the application to decode the image
5. Observe denial of service from the resulting crash

How to detect it

Monitor application and system logs for assertion failures or abrupt terminations originating from Jasper decoder routines when JPEG2000 files are processed.

What your security team should do

• Apply the upstream fix to all instances within the next maintenance window
• Add runtime image-format validation or sandboxing for untrusted files until patched
• Enable crash reporting and alerting on Jasper decoder processes
• Review and restrict image upload surfaces where feasible