CVE-2020-6624

An attacker supplies a crafted JPEG image (the PoC file `id_m075`) that contains a DQT marker section with an invalid or truncated payload. When `process_DQT` reads quantization table data from the heap buffer, it accesses one byte beyond the allocated 67-byte region, causing a heap-buffer-overflow read [ref_id=1]. No authentication or special privileges are required; the victim only needs to run `jhead` on the malicious file.

The heap-buffer-overflow occurs in `process_DQT` at `jpgqguess.c:109` when processing a malformed JPEG quantization table (DQT) section. The crash is triggered via `ReadJpegSections` in `jpgfile.c:223` and `ReadJpegFile` at `jpgfile.c:379`, ultimately invoked from `ProcessFile` in `jhead.c:905`.

The advisory does not include a published patch. The recommended remediation is to add bounds checking in `process_DQT` to verify that the DQT segment length does not exceed the allocated buffer before reading quantization coefficients. Without such a check, any truncated or oversized DQT marker can trigger the out-of-bounds read.