CVE-2026-75466

Received Received - Intake

Integer Division by Zero in libjpeg-turbo PNG Loader

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: MITRE

Description

libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-75466

Affected Vendors & Products

Vendor	Product	Version / Range
libjpeg-turbo	libjpeg-turbo	3.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an integer division-by-zero issue in libjpeg-turbo 3.2.0. It occurs when processing a valid indexed-color PNG image with a non-gray palette through specific functions, leading to a SIGFPE signal and denial of service.

Detection Guidance

This vulnerability can be detected by checking for crashes or SIGFPE errors when processing indexed-color PNG images with non-gray palettes using libjpeg-turbo 3.2.0. Monitor applications using tj3LoadImage12() or tj3LoadImage16() for unexpected terminations.

Impact Analysis

The vulnerability can cause an application to crash or become unresponsive when processing certain PNG images, resulting in a denial of service. This may disrupt services relying on libjpeg-turbo for image processing.

Compliance Impact

This vulnerability causes a denial of service via SIGFPE, which could disrupt systems processing indexed-color PNG images. While not directly tied to compliance, such disruptions may impact availability requirements under GDPR (Article 32) or HIPAA (Security Rule), potentially leading to violations if critical systems are affected.

Mitigation Strategies

Upgrade libjpeg-turbo to a version that fixes the integer division-by-zero issue in the PNG loader. Avoid processing indexed-color PNG images with non-gray palettes using affected functions until patched.

Hi! I’m here to help you understand CVE-2026-75466. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70