Critical Memory Access Issue in libjpeg-turbo: UNKNOWN READ in jpeg_abort
Summary
OSV-2026-1068: UNKNOWN READ in jpeg_abort. Affects libjpeg-turbo versions >= 489dac0575414137ce79e6b59b02848a5fd10bfc, < 76b7feab363d547e06151c8a8aa0ca72ade0594a. Fixed in 76b7feab363d547e06151c8a8aa0ca72ade0594a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjpeg-turbo is a widely used library for handling JPEG image compression and decompression. It is known for its high performance and efficiency, making it a popular choice in various applications that require image processing. However, like any software, it is susceptible to vulnerabilities that can lead to security risks, particularly when handling untrusted input.
Vulnerability Detail
The vulnerability identified as UNKNOWN READ in jpeg_abort arises from a flaw in the libjpeg-turbo library, specifically within the compression functionality. This issue was reported through OSS-Fuzz, indicating a potential crash state that could be exploited by attackers to manipulate memory access. If successfully exploited, this vulnerability could lead to application crashes or unexpected behavior, posing a risk to the integrity and availability of systems relying on this library.
How To Fix
Minimum fixed version
76b7feab363d547e06151c8a8aa0ca72ade0594a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The UNKNOWN READ vulnerability in libjpeg-turbo presents a significant risk that can lead to application instability. It is crucial for users to update to the patched version to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for libjpeg-turbo →
FAQ
The UNKNOWN READ vulnerability refers to a memory access issue that can cause crashes in applications using the libjpeg-turbo library.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to install anything.
Exploitation of this vulnerability could lead to application crashes or unexpected behavior, compromising the stability and security of systems utilizing libjpeg-turbo.
Yes, you should upgrade to any version released after commit '76b7feab363d547e06151c8a8aa0ca72ade0594a' to ensure the vulnerability is patched.
Detailed information can be found in the OSS-Fuzz report linked in the vulnerability details, as well as on the official libjpeg-turbo GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for libjpeg-turbo.
