CVE-2021-46822 Memory corruption in n/a

Medium 5.5 Published 18 Jun 2022 Updated 4 Aug 2024

Heap-based buffer overflow in libjpeg-turbo PPM reader allows attackers to execute arbitrary code or cause denial of service via crafted images.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-46822?

CVE-2021-46822 is a medium-severity memory corruption vulnerability in n/a, published on 18 Jun 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.

Weakness: CWE-787

Which versions are affected by CVE-2021-46822?

It affects 1 product.

Linux distribution packages (19)

`libjpeg-turbo` AlmaLinux:9	All versions	`2.0.90-6.el9_1`
`libjpeg-turbo-devel` AlmaLinux:9	All versions	`2.0.90-6.el9_1`
`libjpeg-turbo-utils` AlmaLinux:9	All versions	`2.0.90-6.el9_1`
`turbojpeg` AlmaLinux:9	All versions	`2.0.90-6.el9_1`
`turbojpeg-devel` AlmaLinux:9	All versions	`2.0.90-6.el9_1`
`libjpeg-turbo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.0.90-6.el9_1`
`libjpeg-turbo-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.0.90-6.el9_1`
`libjpeg-turbo-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.0.90-6.el9_1`
`libjpeg-turbo-devel` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.0.90-6.el9_1`
`libjpeg-turbo-utils` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.0.90-6.el9_1`
`libjpeg-turbo-utils-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.0.90-6.el9_1`
`turbojpeg-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:2.0.90-6.el9_1`
`libjpeg-turbo-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:2.0.90-6.el9_1`
`libjpeg-turbo-debugsource` Red Hat:enterprise_linux:9::crb	All versions	`0:2.0.90-6.el9_1`
`libjpeg-turbo-utils-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:2.0.90-6.el9_1`
`turbojpeg` Red Hat:enterprise_linux:9::crb	All versions	`0:2.0.90-6.el9_1`
`turbojpeg-debuginfo` Red Hat:enterprise_linux:9::crb	All versions	`0:2.0.90-6.el9_1`
`turbojpeg-devel` Red Hat:enterprise_linux:9::crb	All versions	`0:2.0.90-6.el9_1`
`libjpeg-turbo` Rocky Linux:9	All versions	`0:2.0.90-6.el9_1`

Products include Libjpeg-Turbo Libjpeg-Turbo.

How do I fix CVE-2021-46822?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-46822 being exploited?

There is no known exploitation of CVE-2021-46822 in the wild and no public exploit code.

Sources

Also known as ALSA-2023:1068, DEBIAN-CVE-2021-46822, GHSA-p468-hq86-gghc, JLSEC-2025-180, MGASA-2022-0353, OESA-2022-1745 and 4 more.