Critical Use-After-Poison Vulnerability in libjpeg-turbo
Summary
OSV-2026-91: Use-after-poison in compress.cc. Affects libjpeg-turbo versions >= 43b0c0536bde8d367f5031e7990228928650c5b3, < 3eb879acf4ce1efb4750688e864af172d34a4e0a. Fixed in 3eb879acf4ce1efb4750688e864af172d34a4e0a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjpeg-turbo is an open-source library that provides a high-speed implementation of JPEG image compression and decompression. It is widely used in various applications for handling JPEG images due to its efficiency and performance. However, like many software libraries, it can be susceptible to vulnerabilities that may compromise its functionality and security.
Vulnerability Detail
The vulnerability identified in libjpeg-turbo is a use-after-poison issue located in compress.cc. This type of vulnerability occurs when a program continues to use a memory location after it has been freed or marked as invalid, leading to potential crashes or exploitation. The specific crash type reported is a 'Use-after-poison READ 1', which indicates that the program attempted to read from a memory area that has been poisoned, resulting in undefined behavior. This vulnerability can lead to application crashes and may expose sensitive data, making it a critical issue that requires immediate attention.
How To Fix
Minimum fixed version
3eb879acf4ce1efb4750688e864af172d34a4e0a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to update to the patched version as soon as possible to mitigate risks.
Conclusion
The use-after-poison vulnerability in libjpeg-turbo poses significant risks to applications that utilize this library. It is crucial for developers to update to the patched version to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libjpeg-turbo →
FAQ
A use-after-poison vulnerability occurs when a program continues to access memory that has been marked as invalid or freed, leading to potential crashes or exploitation.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply uploading your manifest file like package-lock.json, you can check if your application is affected.
The risks include application crashes, potential data exposure, and exploitation by malicious actors, which could compromise the security of the application.
Currently, there are no specific workarounds available. The best course of action is to update to the patched version as soon as possible.
Detailed information can be found in the OSS-Fuzz report linked in the vulnerability details, as well as on the official libjpeg-turbo GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for libjpeg-turbo.
