CVSS 3.1
7.1 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:HCVE-2021-29390
High (7.1). EPSS 0.8% chance of exploitation in the next 30 days.
libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- libjpeg-turbo:libjpeg-turbo
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1943797
- https://github.com/libjpeg-turbo/libjpeg-turbo/blob/4e52b66f342a803d3b8099b79607e3158d3a241c/jdcoefct.c#L595
- https://github.com/libjpeg-turbo/libjpeg-turbo/commits/main/jdcoefct.c
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/