Vulnerability Database · OSS-Fuzz · Package report
libjpeg-turbo: vulnerability history, versions and safety
libjpeg-turbo is a package in the OSS-Fuzz ecosystem. Vulert records 8 vulnerabilities for it across 5 releases, from Nov 2020 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.
Every vulnerability has a patched version to move to.
No published version shipped hostile code.
Vulert verdict on libjpeg-turbo i
Updated on 23 Oct 2026
Every vulnerability Vulert records for this package has a fix, and the newest was recorded 28 Jul 2026. Apply the fixes listed below and you are clear.
What to do: Move the affected dependencies to the fixed versions listed below, then keep the package monitored so the next vulnerability reaches you. Fix it, then keep watch: Vulert alerts you when a new vulnerability affects the version you run. Monitor it with Vulert →
- Vulnerabilities on record 8 over 5 years · 2 in the last year i
- Latest disclosure 28 Jul 2026 i
- Highest CVSS n/a i
- With no published fix 0 i
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Versions
Which versions are affected
Every version Vulert holds for libjpeg-turbo, newest first, with the vulnerabilities that name it. A version with a count of zero has no recorded vulnerabilities; open a version to see the vulnerabilities it is exposed to.
Newest 5 of 5 versions on record. Severity counts are the vulnerabilities recorded against that exact release.
02 Disclosure history
How often vulnerabilities are recorded
Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 8 were recorded in the last 12 months.
03 Vulnerabilities
Recorded vulnerabilities for libjpeg-turbo
| Vulnerability | Severity | Fixed version ↓ | Disclosed ↓ |
|---|---|---|---|
| Heap-buffer-overflow in decompress_smooth_data in libjpeg-turbo | N/A medium | ccaba5d7894ecfb5a8f11e48d3f86e1f14d5a469 | 26 Nov 2020 |
| Heap-buffer-overflow in get_word_rgb_row in libjpeg-turbo | N/A high | f35fd27ec641c42d6b115bfa595e483ec58188d2 | 07 Apr 2021 |
| Heap-buffer-overflow in decode_mcu_fast in libjpeg-turbo | N/A high | 4de8f6922a9be7d0a51a429e367283fd40031b26 | 18 Apr 2021 |
| Invalid-free vulnerability in libjpeg-turbo | N/A high | 95881ce8241deb2ca70dd35399009bbdfc99cff5 | 06 Jul 2023 |
| Uninitialized Value Vulnerability in libjpeg-turbo: Use-of-Uninitialized-Value in decompress_yuv.cc | N/A medium | 0253e338861f1b15ccf530f83d0d2914d6235e0a | 30 Sep 2024 |
Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback
Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315
