CVE-2018-16781

Vulnerability

The vulnerability resides in the ffjpeg.dll library of ffjpeg prior to 2018-08-22. When processing a progressive JPEG file that lacks an AC Huffman table, a floating point exception (FPE) occurs, leading to a crash. This bug is triggered during the decoding of such malformed images [1].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted progressive JPEG image without an AC Huffman table to an application using ffjpeg. No authentication or special privileges are required. The attacker can deliver the file via typical vectors such as email attachments, web uploads, or any channel where the image is processed by the library [1].

Impact

Successful exploitation results in a denial of service (DoS) due to a fatal FPE signal, causing the application to crash. No code execution, information disclosure, or privilege escalation has been reported; the impact is limited to availability [1].

Mitigation

The issue is addressed in ffjpeg versions released after 2018-08-22. Users should update to the latest version. No other workarounds are available; if updating is not possible, avoid processing untrusted JPEG files with ffjpeg [1].