{"id":"CVE-2026-75466","aliases":["BELL-CVE-2026-75466","DEBIAN-CVE-2026-75466","EUVD-2026-66663","GHSA-8cx9-6hv6-67qj","UBUNTU-CVE-2026-75466","openSUSE-SU-2026:12399-1"],"status":"published","title":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When...","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00355,"percentile":0.29422,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-369"],"published":"2026-08-26T00:00:00Z","modified":"2026-11-09T12:52:31Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"libjpeg-turbo","fixed_in":["8.3.2-86.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-0ubuntu1","1.3.0-0ubuntu2","1.3.0-0ubuntu2.1","1.3.0-0ubuntu2.1+esm1","1.3.0-0ubuntu2.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg6b","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6b1-3ubuntu1","6b1-4ubuntu1","6b1-4ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0-0ubuntu2","1.4.2-0ubuntu1","1.4.2-0ubuntu2","1.4.2-0ubuntu3","1.4.2-0ubuntu3.1","1.4.2-0ubuntu3.3","1.4.2-0ubuntu3.4","1.4.2-0ubuntu3.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libjpeg6b","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6b2-2","1:6b2-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libjpeg9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9a-2ubuntu1","1:9b-1","1:9b-1ubuntu1","1:9b-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-0ubuntu5","1.5.2-0ubuntu5.18.04.1","1.5.2-0ubuntu5.18.04.3","1.5.2-0ubuntu5.18.04.4","1.5.2-0ubuntu5.18.04.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg6b","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6b2-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9b-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.3-0ubuntu1","2.0.3-0ubuntu1.20.04.1","2.0.3-0ubuntu1.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg6b","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6b2-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9c-2","1:9d-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.6-0ubuntu2","2.0.6-0ubuntu3","2.1.1-0ubuntu1","2.1.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libjpeg6b","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6b2-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libjpeg9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9d-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.5-2ubuntu1","2.1.5-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.5-4ubuntu4","1:3.1.3-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libjpeg6b","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6b2-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libjpeg9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9f-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.5-4ubuntu2","2.1.5-4ubuntu3","2.1.5-4ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libjpeg6b","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6b2-4","1:6b2-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libjpeg9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9f-2","1:9f-2build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.2-86.1"}]}]}],"references":[{"url":"https://github.com/libjpeg-turbo/libjpeg-turbo/issues/911","tags":["exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75466"},{"url":"https://github.com/advisories/GHSA-8cx9-6hv6-67qj"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-75466","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-75466","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-75466","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75466","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75466","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T19:04:36.833Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-66663","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-08-27T19:04:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:01:26.820985Z"}],"ghsa":[{"id":"GHSA-8cx9-6hv6-67qj","title":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When...","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.","status":"published","published":"2026-08-26T21:31:42Z","modified":"2026-08-27T21:32:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T15:11:05.645531Z"}],"nvd":[{"id":"CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.","status":"published","published":"2026-08-26T19:17:03.787Z","modified":"2026-09-09T16:04:24.933Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"BELL-CVE-2026-75466","title":"CVE-2026-75466 does not affect BellSoft software","status":"withdrawn","published":"2026-09-03T06:05:36.164839Z","modified":"2026-09-17T07:15:07.367070358Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"UBUNTU-CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.","status":"published","published":"2026-08-26T19:17:00Z","modified":"2026-11-09T12:52:31.103146501Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-09T13:26:11.50143Z"},{"id":"DEBIAN-CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.","status":"withdrawn","published":"2026-08-26T19:17:03.787Z","modified":"2026-08-27T08:00:15.273635952Z","updated_at":"2026-11-02T15:46:03.004924Z"},{"id":"openSUSE-SU-2026:12399-1","title":"libjpeg-turbo-3.2.1-86.1 on GA media","description":"These are all security issues fixed in the libjpeg-turbo-3.2.1-86.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T17:23:21.441411068Z","updated_at":"2026-11-04T17:43:22.558805Z"}]}}