CVE-2026-75466 in libjpeg-turbo
Summary
by MITRE • 08/26/2026
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in libjpeg-turbo version 3.2.0 represents a critical flaw within its PNG image processing subsystem, specifically affecting the handling of indexed-color images with non-gray palettes. This integer division-by-zero error is triggered when the library processes specific valid PNG files through the tj3LoadImage12() or tj3LoadImage16() functions while utilizing the default pixel format. The root cause lies in the alloc_sarray function, which performs a mathematical operation that fails to account for edge cases where the divisor evaluates to zero under certain palette configurations. This technical flaw allows an attacker who can supply maliciously crafted PNG images to induce a fatal signal exception, specifically SIGFPE, within the host application.
From a security architecture perspective, this vulnerability is classified as CWE-369, which denotes divide-by-zero errors that lead to software crashes or unexpected behavior. The impact of this flaw is primarily centered on availability, manifesting as a denial-of-service condition for any application relying on libjpeg-turbo for image decoding. When the division by zero occurs, the process terminates abruptly without graceful error handling, potentially disrupting services that depend on continuous image processing capabilities. This aligns with ATT&CK technique T1499, Endpoint Denial of Service, where an adversary exploits software vulnerabilities to degrade or halt system functionality rather than gaining unauthorized access or exfiltrating data.
The operational impact extends beyond simple application crashes if the vulnerable library is integrated into larger systems such as web servers, image processing pipelines, or embedded devices that automatically process user-uploaded content. An attacker could craft a series of PNG files designed to trigger this specific code path repeatedly, causing sustained service outages for downstream consumers of these images. Since libjpeg-turbo is widely used in high-performance environments due to its optimized SIMD instructions, the widespread adoption increases the potential blast radius of this vulnerability across various industries including web hosting, digital media management, and IoT device firmware processing.
Mitigation strategies should prioritize immediate patching by updating libjpeg-turbo to a version that includes fixes for this integer overflow condition. Developers integrating this library must ensure their build pipelines enforce strict dependency updates to mitigate exposure. In the interim, if upgrading is not immediately feasible, input validation mechanisms can be implemented at the application layer to reject PNG files with non-gray palettes before they reach the vulnerable decoding functions. Additionally, deploying runtime protection systems that monitor for SIGFPE signals and isolate crashing processes can help contain the impact of exploitation attempts while longer-term remediation efforts are underway.