Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-13960: libjpeg-turbo may consume excessive memory on malformed JPEG

CVE-2019-13960 · published 7 years ago

Summary

The libjpeg-turbo library can use a lot of memory when it tries to process a progressive JPEG file that has incorrect width or height information. This could slow down or crash applications that rely on the library. To prevent this, configure the software to treat libjpeg warnings as fatal errors, limit image sizes, or set resource usage caps.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
libjpeg-turbo	libjpeg-turbo	2.0.2 `cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:2.0.2:::::::*`

Original advisory text

In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height values in the image header. NOTE: the vendor's expectation, for use cases in which this memory usage would be a denial of service, is that the application should interpret libjpeg warnings as fatal errors (aborting decompression) and/or set limits on resource consumption or image sizes

References

https://github.com/libjpeg-turbo/libjpeg-turbo/issues/337 Exploit Third Party Advisory
https://libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf Exploit Patch Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published18 Jul 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2019-13960 · NVD

Track software like this

Free during beta