CVE-2026-24797
Out-of-Bounds Write in cupoch libjpeg-turbo Module
Publication date: 2026-01-27
Last updated on: 2026-01-27
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| neka-nat | cupoch | From 3.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds write issue in the decomp() function within the tjbench.c file of the cupoch project, which uses a cloned version of the libjpeg-turbo library. The problem arose because the cloned code did not include a critical security patch from the original libjpeg-turbo repository. This patch fixes signed integer overflow and potential segmentation faults that occur when decompressing very large images (larger than about 715 million pixels). Without this fix, decompressing such large images could cause memory corruption or crashes. [1]
How can this vulnerability impact me? :
This vulnerability can lead to memory corruption or segmentation faults when decompressing very large images, potentially causing application crashes or unexpected behavior. Such out-of-bounds writes could be exploited to execute arbitrary code or cause denial of service, impacting the stability and security of systems using the affected cupoch library for image processing. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the cupoch project to include the security patch applied in pull request #138, which fixes the decomp() function in tjbench.c by incorporating the original libjpeg-turbo fix that prevents signed integer overflow and segmentation faults during decompression of very large images. Applying this patch will eliminate the out-of-bounds write vulnerability. [1]