Every CVE Search/ Get API key

CVE-2016-3616

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer...

8.8 HighFix available

CVE-2016-3616 is a high vulnerability (CVSS 8.8) in Canonical Ubuntu Linux, published February 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.22%, the 91st percentile. Fixed in libjpeg-turbo 1:1.4.2-1.

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

4.22%Up 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

Record
CVE-2016-3616
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

Record
CVE-2016-3616
Updated
2026-11-02
EUVDEUVD-2016-4642 No score

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

Record
EUVD-2016-4642
Updated
2026-11-03
GitHub AdvisoriesGHSA-pj5x-cj5m-45mx 8.8

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer...

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

Record
GHSA-pj5x-cj5m-45mx
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 8.8

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

Record
CVE-2016-3616
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-3616 8.8

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

Record
DEBIAN-CVE-2016-3616
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2019:2052 6.5

Red Hat Security Advisory: libjpeg-turbo security update

Record
RHSA-2019:2052
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-3616 8.8

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

Record
UBUNTU-CVE-2016-3616
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-3706-1 No score

libjpeg-turbo vulnerabilities

It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricked into opening a specially crafted JPEG image, a remote attacker could cause libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-3706-1
Updated
2026-11-02
OSVUSN-5336-1 No score

libjpeg9 vulnerabilities

Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's size. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2016-3616)

It was discovered that the cjpeg utility in libjpeg9 incorrectly handled certain input. An attacker could possibly use these issues to cause a denial of service. (CVE-2018-11212, CVE-2018-11813, CVE-2020-14152, CVE-2020-14153)

It was discovered that the cjpeg utility in libjpeg9 incorrectly handled memory when supplied with certain input. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code. (CVE-2018-11213, CVE-2018-11214)

Record
USN-5336-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libjpeg-turbo
Debian:12
 before 1:1.4.2-1
1:1.4.2-1
libjpeg-turbo
Debian:13
 before 1:1.4.2-1
1:1.4.2-1
libjpeg-turbo
Debian:14
 before 1:1.4.2-1
1:1.4.2-1
libjpeg-turbo
Debian:8
 before 1:1.3.1-12+deb8u1, plus listed versions
1:1.3.1-12
1:1.3.1-12+deb8u1
libjpeg-turbo
Red Hat:enterprise_linux:7::client
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-devel
Red Hat:enterprise_linux:7::client
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-static
Red Hat:enterprise_linux:7::client
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-utils
Red Hat:enterprise_linux:7::client
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
turbojpeg
Red Hat:enterprise_linux:7::client
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
Show 27 moreShow less
Affected packages
PackageAffectedFixed
turbojpeg-devel
Red Hat:enterprise_linux:7::client
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-static
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-utils
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
turbojpeg
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
turbojpeg-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo
Red Hat:enterprise_linux:7::server
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-devel
Red Hat:enterprise_linux:7::server
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-static
Red Hat:enterprise_linux:7::server
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-utils
Red Hat:enterprise_linux:7::server
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
turbojpeg
Red Hat:enterprise_linux:7::server
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
turbojpeg-devel
Red Hat:enterprise_linux:7::server
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-static
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo-utils
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
turbojpeg
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
turbojpeg-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.2.90-8.el7
0:1.2.90-8.el7
libjpeg-turbo
Ubuntu:14.04:LTS
 before 1.3.0-0ubuntu2.1, plus listed versions
1.3.0-0ubuntu11.3.0-0ubuntu2
1.3.0-0ubuntu2.1
libjpeg9
Ubuntu:Pro:16.04:LTS
 before 1:9b-1ubuntu1+esm1, plus listed versions
1:9a-2ubuntu11:9b-11:9b-1ubuntu1
1:9b-1ubuntu1+esm1
libjpeg9
Ubuntu:18.04:LTS
 before 1:9b-2
1:9b-2
libjpeg-turbo
Ubuntu:16.04:LTS
 before 1.4.2-0ubuntu3.1, plus listed versions
1.3.0-0ubuntu21.4.2-0ubuntu11.4.2-0ubuntu21.4.2-0ubuntu3
1.4.2-0ubuntu3.1
libjpeg-turbo
Ubuntu:18.04:LTS
 before 1.5.2-0ubuntu5.18.04.1, plus listed versions
1.5.2-0ubuntu5
1.5.2-0ubuntu5.18.04.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open