CVE-2021-39518

Vulnerability

A heap-based buffer overflow exists in LineBuffer::FetchRegion() at linebuffer.cpp:322 of libjpeg through commit e52406 (approximately 2020021). The overflow occurs when the function performs a memcpy operation on a buffer allocated from the heap, without proper bounds checking on the source Line pointer data. The issue is triggered through the provided test case using command-line arguments -oz -h -s 1x1,2x2,2x2 @@ /dev/null against a crafted JPEG file that contains invalid markers and missing EOI markers [1].

Exploitation

An attacker must supply a specially crafted JPEG file to the jpeg command-line tool (or any application using the affected libjpeg library). The attacker does not need any special network position or authentication beyond the ability to deliver the file. When the tool processes the malformed image, it reaches LineBuffer::FetchRegion() via the call chain Image::ReconstructRegion() -> LineBitmapRequester::ReconstructRegion() -> LineBuffer::FetchRegion(). The insufficient input validation in the line buffer handling leads to a heap buffer overflow during the memcpy call, as demonstrated by the AddressSanitizer report showing a read of size 32 at an address 0 bytes to the right of a 208-byte allocated region [1].

Impact

Successful exploitation results in a heap-buffer-overflow read, which in the provided PoC crashes the application with a segmentation fault. This could potentially be leveraged by an attacker to read adjacent heap memory (information disclosure) or, under certain conditions, corrupt memory and achieve arbitrary code execution, though the referenced issue only demonstrates a crash [1].

Mitigation

As of the referenced GitHub issue (September 2021), no official fix had been released. The libjpeg project appears to be dormant (the latest version mentioned is 2020021). Users should consider discontinuing use of this library and migrating to maintained alternatives such as libjpeg-turbo or mozjpeg. No CISA KEV listing exists for this CVE. Workarounds include avoiding processing untrusted JPEG files with the affected libjpeg tools.