CVE-2021-29390
libjpeg-turbo version 2.0.90 is vulnerable to a heap-buffer-overflow vulnerability in...
libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
- Record
CVE-2021-29390- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
- Record
CVE-2021-29390- Updated
- 2026-11-02
EUVDEUVD-2021-16025 No score
libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
- Record
EUVD-2021-16025- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3f9q-r2pw-87vm
libjpeg-turbo version 2.0.90 is vulnerable to a heap-buffer-overflow vulnerability in...
libjpeg-turbo version 2.0.90 is vulnerable to a heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c.
- Record
GHSA-3f9q-r2pw-87vm- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
- Record
CVE-2021-29390- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:2295
Red Hat Security Advisory: libjpeg-turbo security update
- Record
RHSA-2024:2295- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVRLSA-2024:2295
Moderate: libjpeg-turbo security update
The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.
Security Fix(es):
- libjpeg-turbo: heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c (CVE-2021-29390)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.
- Record
RLSA-2024:2295- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-29390
libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
- Record
UBUNTU-CVE-2021-29390- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2024:2295 No score
Moderate: libjpeg-turbo security update
The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.
Security Fix(es):
- libjpeg-turbo: heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c (CVE-2021-29390)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:2295- Updated
- 2026-11-02
OSVCLSA-2025-1744631931 No score
libjpeg-turbo: Fix of CVE-2021-29390
- CVE-2021-29390: fix buffer overrun with certain narrow prog JPEGs
- Record
CLSA-2025-1744631931- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libjpeg-turboAlmaLinux:9 |
before 2.0.90-7.el9 | 2.0.90-7.el9 |
libjpeg-turbo-develAlmaLinux:9 |
before 2.0.90-7.el9 | 2.0.90-7.el9 |
libjpeg-turbo-utilsAlmaLinux:9 |
before 2.0.90-7.el9 | 2.0.90-7.el9 |
turbojpegAlmaLinux:9 |
before 2.0.90-7.el9 | 2.0.90-7.el9 |
turbojpeg-develAlmaLinux:9 |
before 2.0.90-7.el9 | 2.0.90-7.el9 |
libjpeg-turboTuxCare:AlmaLinux:9.2 |
before 2.0.90-6.el9_2.tuxcare.els1 | 2.0.90-6.el9_2.tuxcare.els1 |
libjpeg-turbo-develTuxCare:AlmaLinux:9.2 |
before 2.0.90-6.el9_2.tuxcare.els1 | 2.0.90-6.el9_2.tuxcare.els1 |
libjpeg-turbo-utilsTuxCare:AlmaLinux:9.2 |
before 2.0.90-6.el9_2.tuxcare.els1 | 2.0.90-6.el9_2.tuxcare.els1 |
turbojpegTuxCare:AlmaLinux:9.2 |
before 2.0.90-6.el9_2.tuxcare.els1 | 2.0.90-6.el9_2.tuxcare.els1 |
turbojpeg-develTuxCare:AlmaLinux:9.2 |
before 2.0.90-6.el9_2.tuxcare.els1 | 2.0.90-6.el9_2.tuxcare.els1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libjpeg-turboRed Hat:enterprise_linux:9::appstream |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
libjpeg-turbo-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
libjpeg-turbo-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
libjpeg-turbo-develRed Hat:enterprise_linux:9::appstream |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
libjpeg-turbo-utilsRed Hat:enterprise_linux:9::appstream |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
libjpeg-turbo-utils-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
turbojpeg-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
libjpeg-turbo-debuginfoRed Hat:enterprise_linux:9::crb |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
libjpeg-turbo-debugsourceRed Hat:enterprise_linux:9::crb |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
libjpeg-turbo-utils-debuginfoRed Hat:enterprise_linux:9::crb |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
turbojpegRed Hat:enterprise_linux:9::crb |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
turbojpeg-debuginfoRed Hat:enterprise_linux:9::crb |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
turbojpeg-develRed Hat:enterprise_linux:9::crb |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
libjpeg-turboRocky Linux:9 |
before 0:2.0.90-7.el9 | 0:2.0.90-7.el9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-29390 is a high vulnerability (CVSS 7.1) in Libjpeg-turbo, published August 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in libjpeg-turbo 2.0.90-7.el9.
References
bugzilla.redhat.com/show_bug.cgi?id=1943797
github.com/libjpeg-turbo/libjpeg-turbo/blob/4e52b66f342a803d3b8099b79607e3158d3a241c/jdcoefct.c
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC
Show 21 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-29390
access.redhat.com/errata/RHSA-2024:2295
errata.almalinux.org/9/ALSA-2024-2295.html
errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1744631931.html
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2295.json
cve.org/CVERecord?id=CVE-2021-29390
errata.rockylinux.org/RLSA-2024:2295
ubuntu.com/security/CVE-2021-29390