Description
libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the put_pixel_rows function in wrbmp.c, as demonstrated by djpeg.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libjpeg-turbo | 1.5.2-0ubuntu5.18.04.3 | USN-4190-1 |
| Ubuntu 16.04 LTS | libjpeg-turbo | 1.4.2-0ubuntu3.3 | USN-4190-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libjpeg-turbo | 8.2.2-65.2 | openSUSE-SU-2024:10952-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.23 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.22 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.21 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.20 | libjpeg-turbo | 2.0.2-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.18 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.17 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.16 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.15 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.14 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.13 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.12 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.11 | libjpeg-turbo | 2.0.2-r0 | — |
| Alpine v3.10 | libjpeg-turbo | 2.0.2-r0 | — |
Advisories 2
- USN-4190-1 libjpeg-turbo vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10952-1 libjpeg-turbo-2.1.1-65.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/libjpeg-turbo/libjpeg-turbo/issues/305
- USN-4190-1 vendor-advisory