CVE-2023-2804 Memory corruption in libjpeg-turbo
A heap-based buffer overflow in libjpeg-turbo allows attackers to cause application crashes via crafted 12-bit JPEG images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-2804?
CVE-2023-2804 is a medium-severity memory corruption vulnerability in libjpeg-turbo, published on 25 May 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.
Which versions are affected by CVE-2023-2804?
It affects 1 product.
Linux distribution packages (1)
libjpeg-turbo openSUSE:Tumbleweed | All versions | 8.3.2-77.1 |
Products include Libjpeg-Turbo Libjpeg-Turbo.
How do I fix CVE-2023-2804?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-2804 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2804 exists.
Other vulnerabilities in libjpeg-turbo
Sources
Also known as ALPINE-CVE-2023-2804, CLEANSTART-2026-EW60545, CVE-2023-31813, GHSA-jv36-3qpq-7g23, openSUSE-SU-2024:13552-1.