Heap-based buffer overflow in libjpeg-turbo
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Microsoft. Impact type from Microsoft.
Summary
A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | libjpeg-turbo | Fixed in libjpeg-turbo v3.0 (beta2) | — | No fix listed | CNA |
- libjpeg-turbo Vendor— Affected Fixed in libjpeg-turbo v3.0 (beta2) Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:2.1.90:*:*:*:*:*:*:* | 2.1.90 | Vulnerable | Libjpeg-turbo |
- cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:2.1.90:*:*:*:*:*:*:* Versions 2.1.90 Vulnerable ·Libjpeg-turbo
Remediation
Microsoft 1 update
- Security Update
- Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.2149
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Microsoft
Microsoft's page for this CVE →
- Impact
- Remote Code Execution
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
Timeline
- 2026-10-02 Threatist record created from CVE-2023-2804
- 2026-10-03 Alias added: GHSA-jv36-3qpq-7g23
References
Exploit 2
Patch 2
More Libjpeg-turbo vulnerabilities
- TI-2021-10123 libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c. CVSS 3.1HIGH 7.1
- TI-2016-03069 The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL… CVSS 3.0HIGH 8.8
- TI-2020-13284 Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. CVSS 3.1HIGH 8.8
- TI-2018-14387 The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant… CVSS 3.0HIGH 8.8
- TI-2020-10780 libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in… CVSS 3.1HIGH 8.1
- TI-2018-01068 libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a… CVSS 3.0MEDIUM 6.5
Sources
- CVE-2023-2804 · CVE Program
- CVE-2023-2804 · NVD
- FIRST EPSS
- GHSA-jv36-3qpq-7g23 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-2804 · Microsoft Security Update Guide
- CVE-2023-2804 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences