CVE-2020-35538
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed...
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
CVE-2020-35538- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
CVE-2020-35538- Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2020-23205 No score
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
EUVD-2020-23205- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-grwc-h387-x9h2
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed...
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
GHSA-grwc-h387-x9h2- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-35538
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
ALPINE-CVE-2020-35538- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-10824
CVE-2020-35538 affecting package libjpeg-turbo for versions less than 2.1.4-1
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
AZL-10824- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSVAZL-43462
CVE-2020-35538 affecting package gdal 3.6.3-5
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
AZL-43462- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-44676
CVE-2020-35538 affecting package gdal 3.6.3-2
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
AZL-44676- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSVBELL-CVE-2020-35538
CVE-2020-35538 does not affect BellSoft software
- Record
BELL-CVE-2020-35538- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
CVE-2020-35538- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
OSVDEBIAN-CVE-2020-35538
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
DEBIAN-CVE-2020-35538- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVOESA-2022-1915
libjpeg-turbo security update
libjpeg-turbo is a JPEG image codec that uses SIMD instructions (MMX, SSE2, NEON, AltiVec) to accelerate baseline JPEG compression and decompression on x86, x86-64, and ARM systems.
Security Fix(es):
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.(CVE-2020-35538)
- Record
OESA-2022-1915- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2022-1916
libjpeg-turbo security update
libjpeg-turbo is a JPEG image codec that uses SIMD instructions (MMX, SSE2, NEON, AltiVec) to accelerate baseline JPEG compression and decompression on x86, x86-64, and ARM systems.
Security Fix(es):
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.(CVE-2020-35538)
- Record
OESA-2022-1916- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-35538
A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
- Record
UBUNTU-CVE-2020-35538- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2022:3475-1 No score
Security update for libjpeg-turbo
This update for libjpeg-turbo fixes the following issues:
- CVE-2020-35538: Fixed null pointer dereference in jcopy_sample_rows() function (bsc#1202915).
- Record
SUSE-SU-2022:3475-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3523-1 No score
Security update for libjpeg-turbo
This update for libjpeg-turbo fixes the following issues:
- CVE-2020-35538: Fixed null pointer dereference in jcopy_sample_rows() function (bsc#1202915).
- Record
SUSE-SU-2022:3523-1- Updated
- 2026-11-02
OSVUSN-5631-1 No score
libjpeg-turbo vulnerabilities
It was discovered that libjpeg-turbo incorrectly handled certain EOF characters. An attacker could possibly use this issue to cause libjpeg-turbo to consume resource, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-11813)
It was discovered that libjpeg-turbo incorrectly handled certain malformed jpeg files. An attacker could possibly use this issue to cause libjpeg-turbo to crash, resulting in a denial of service. (CVE-2020-17541, CVE-2020-35538)
It was discovered that libjpeg-turbo incorrectly handled certain malformed PPM files. An attacker could use this issue to cause libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-46822)
- Record
USN-5631-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libjpeg-turboAlpine:v3.17 |
before 2.0.6-r0 | 2.0.6-r0 |
libjpeg-turboAlpine:v3.18 |
before 2.0.6-r0 | 2.0.6-r0 |
libjpeg-turboAlpine:v3.19 |
before 2.0.6-r0 | 2.0.6-r0 |
libjpeg-turboAlpine:v3.20 |
before 2.0.6-r0 | 2.0.6-r0 |
libjpeg-turboAlpine:v3.21 |
before 2.0.6-r0 | 2.0.6-r0 |
libjpeg-turboAlpine:v3.22 |
before 2.0.6-r0 | 2.0.6-r0 |
libjpeg-turboAlpine:v3.23 |
before 2.0.6-r0 | 2.0.6-r0 |
libjpeg-turboAlpine:v3.24 |
before 2.0.6-r0 | 2.0.6-r0 |
libjpeg-turboAzure Linux:2 |
before 2.1.4-1 | 2.1.4-1 |
gdalAzure Linux:2 |
through 3.6.3-5 | None known |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gdalAzure Linux:3 |
through 3.6.3-2 | None known |
libjpeg-turboDebian:12 |
before 1:2.0.6-1 | 1:2.0.6-1 |
libjpeg-turboDebian:13 |
before 1:2.0.6-1 | 1:2.0.6-1 |
libjpeg-turboDebian:14 |
before 1:2.0.6-1 | 1:2.0.6-1 |
libjpeg-turboopenEuler:20.03-LTS-SP1 |
before 2.0.5-3.oe1 | 2.0.5-3.oe1 |
libjpeg-turboopenEuler:20.03-LTS-SP3 |
before 2.0.5-3.oe1 | 2.0.5-3.oe1 |
libjpeg-turboSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.5.3-31.28.1 | 1.5.3-31.28.1 |
libjpeg62-turboSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.5.3-31.28.1 | 1.5.3-31.28.1 |
libjpeg-turboSUSE:Linux Enterprise Server 12 SP5 |
before 1.5.3-31.28.1 | 1.5.3-31.28.1 |
libjpeg62-turboSUSE:Linux Enterprise Server 12 SP5 |
before 1.5.3-31.28.1 | 1.5.3-31.28.1 |
libjpeg-turboSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.5.3-31.28.1 | 1.5.3-31.28.1 |
libjpeg62-turboSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.5.3-31.28.1 | 1.5.3-31.28.1 |
libjpeg-turboSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg62-turboSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg-turboSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg-turboSUSE:Linux Enterprise Module for Package Hub 15 SP3 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg-turboSUSE:Linux Enterprise Micro 5.1 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg-turboSUSE:Linux Enterprise Micro 5.2 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg-turboopenSUSE:Leap Micro 5.2 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg-turboopenSUSE:Leap 15.3 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg62-turboopenSUSE:Leap 15.3 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg62-turboopenSUSE:Leap 15.4 |
before 1.5.3-150000.32.5.1 | 1.5.3-150000.32.5.1 |
libjpeg-turboUbuntu:18.04:LTS |
before 1.5.2-0ubuntu5.18.04.6, plus listed versions 1.5.2-0ubuntu51.5.2-0ubuntu5.18.04.11.5.2-0ubuntu5.18.04.31.5.2-0ubuntu5.18.04.4 |
1.5.2-0ubuntu5.18.04.6 |
libjpeg-turboUbuntu:20.04:LTS |
before 2.0.3-0ubuntu1.20.04.3, plus listed versions 2.0.3-0ubuntu12.0.3-0ubuntu1.20.04.1 |
2.0.3-0ubuntu1.20.04.3 |
libjpeg-turboUbuntu:18.04:LTS From an advisory covering 4 CVEs |
before 1.5.2-0ubuntu5.18.04.6, plus listed versions 1.5.2-0ubuntu51.5.2-0ubuntu5.18.04.11.5.2-0ubuntu5.18.04.31.5.2-0ubuntu5.18.04.4 |
1.5.2-0ubuntu5.18.04.6 |
libjpeg-turboUbuntu:20.04:LTS From an advisory covering 4 CVEs |
before 2.0.3-0ubuntu1.20.04.3, plus listed versions 2.0.3-0ubuntu12.0.3-0ubuntu1.20.04.1 |
2.0.3-0ubuntu1.20.04.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| facts | OSV | |
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-35538 is a medium vulnerability (CVSS 5.5) in Libjpeg-turbo, published August 31, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in libjpeg-turbo 2.0.6-r0.
References
github.com/libjpeg-turbo/libjpeg-turbo/issues/441
nvd.nist.gov/vuln/detail/CVE-2020-35538
security.alpinelinux.org/vuln/CVE-2020-35538
docs.bell-sw.com/security/cves/CVE-2020-35538
Show 14 moreShow less
security-tracker.debian.org/tracker/CVE-2020-35538
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1915
suse.com/support/update/announcement/2022/suse-su-20223475-1
bugzilla.suse.com/1202915
ubuntu.com/security/CVE-2020-35538
access.redhat.com/security/cve/CVE-2020-35538
cve.org/CVERecord?id=CVE-2020-35538