CVE-2014-9029

CVE-2014-9029 describes multiple off-by-one errors in the JasPer library (versions 1.900.1 and earlier), specifically within the jpc_dec_cp_setfromcox and jpc_dec_cp_setfromrgn functions. These flaws allow remote attackers to execute arbitrary code by crafting a malicious JP2 file, leading to a heap-based buffer overflow. With a CVSS score of 7.5 (High), this vulnerability is easily exploitable over the network with low attack complexity, potentially resulting in partial confidentiality, integrity, and availability impacts. Despite its high severity and EPSS score, there is no evidence of active exploitation, nor are there publicly available exploit modules or significant community discussion surrounding this CVE.