CVE-2026-75466
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.
Risk Assessment
An attacker can cause an application crash (denial of service) by providing a specially crafted PNG file, potentially disrupting services that use libjpeg-turbo.
Recommendation
Update libjpeg-turbo to a version that includes a fix for this vulnerability. If not available, restrict processing of untrusted PNG files.
Other vulnerabilities in libjpeg-turbo
See all- CVE-2017-9614High
The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file.
- CVE-2020-35538Medium
A vulnerability in libjpeg-turbo causes a null pointer dereference in jcopy_sample_rows() when processing a crafted input file. This can lead to a crash of the application using the library.
Original NVD description (English source)
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS