CVE-2023-2804 Red Hat, Inc. CVE-2023-2804: Heap Based Overflow libjpeg

Api.Msrc.Microsoft • February 10, 2026

A heap‑based buffer overflow exists in libjpeg‑turbo’s h2v2_merged_upsample_internal() function when processing 12‑bit lossless JPEG images. An attacker could craft an image containing out‑of‑range 12‑bit samples that, when decompressed with merged upsampling enabled, may trigger a segmentation fault or buffer overflow, resulting in an application crash.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Heap Buffer Overflow Vulnerabilities in Image Processing Libraries Recent vulnerabilities have been identified in image processing libraries, including a heap-based buffer overflow in libjpeg-turbo (CVE-2023-2804) that affects 12-bit lossless JPEG images, potentially leading to application crashes. Additionally, CVE-2016-9535 has been updated with affected software for Windows packages, and CVE-2025-34297 involves an integer overflow in KissFFT. These vulnerabilities may impact various applications that utilize these libraries. 23 sources 44

Extracted Entities

CVEs (1)

CVE-2023-2804