CVE-2020-35538
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in libjpeg-turbo causes a null pointer dereference in jcopy_sample_rows() when processing a crafted input file. This can lead to a crash of the application using the library.
Risk Assessment
An attacker can supply a malicious image file, causing a denial of service in the image processing service. The risk affects applications and services using libjpeg-turbo for image decoding.
Recommendation
Update libjpeg-turbo to a patched version or validate input files before processing. Consider restricting processing of untrusted images.
Other vulnerabilities in libjpeg-turbo
See all- CVE-2017-9614High
The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file.
- CVE-2026-75466Medium
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.
Original NVD description (English source)
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS