Executive brief
libjpeg-turbo is a widely-used library for JPEG and image processing. A flaw in its PNG image loader can cause the application to crash with a denial-of-service when processing valid indexed-color PNG images with non-grayscale palettes. An attacker can trigger this by sending a specially-crafted but valid PNG file.
Technical details
The vulnerability is an integer division-by-zero (CWE-369) in alloc_sarray() triggered through the TurboJPEG image loader API (tj3LoadImage12() / tj3LoadImage16()). When processing a valid 8-bit indexed-color PNG with a non-grayscale palette, the PNG reader's indexed-color branch fails to properly set cinfo->in_color_space, leaving it at JCS_UNKNOWN. This causes cinfo->input_components to remain 0, which later propagates into alloc_sarray() where (samplesperrow * sample_size) becomes 0, triggering a CPU division-by-zero exception (#DE) and SIGFPE signal. The attack requires no authentication and only involves sending a valid, non-malformed PNG file. No memory corruption occurs; the impact is deterministic denial of service. A patch should add a fallback case in the indexed-color branch to properly handle non-grayscale palettes.
Affected products
- libjpeg-turbo libjpeg-turbo 3.2.0, 3.2.1
Timeline
- 2026-08-26: disclosed