CVE catalog

CVE-2021-29390

libjpeg-turbo: CVE-2021-29390

Severity: High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Published: Aug 22, 2023, 7:16:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.82% · Oct 25, 2026

A heap buffer over-read flaw was found in libjpeg-turbo. For certain types of smoothed jpeg images, the decompress_smooth_data() function may improperly enter a condition statement that leads to heap memory read of uninitialized data, which may cause an application crash or loss of confidentiality. libjpeg-turbo: heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c The amount of memory read is very small and not controllable by an attacker, which lowers the impact of this flaw to Moderate. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libjpeg-turbo	sid	`1:3.1.3-4`	not affected
Debian	libjpeg-turbo	forky	`1:3.1.3-4`	not affected
Debian	libjpeg-turbo	trixie	`1:2.1.5-4`	not affected
Debian	libjpeg-turbo	bookworm	`1:2.1.5-2`	not affected

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libjpeg-turbo	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	libjpeg-turbo	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	libjpeg-turbo	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	libjpeg-turbo	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libjpeg62-turbo]Not affected
Source package: [libjpeg-turbo]
Details (2)
- 1:2.1.5-2 · amd64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
- 1:2.1.5-2 · arm64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
[libjpeg62-turbo-dev]Not affected
Source package: [libjpeg-turbo]
Details (2)
- 1:2.1.5-2 · amd64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
- 1:2.1.5-2 · arm64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
[libjpeg-dev]Not affected
Source package: [libjpeg-turbo]
Details (2)
- 1:2.1.5-2 · amd64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
- 1:2.1.5-2 · arm64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
[libjpeg-turbo-progs]Not affected
Source package: [libjpeg-turbo]
Details (2)
- 1:2.1.5-2 · amd64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
- 1:2.1.5-2 · arm64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
[libturbojpeg0]Not affected
Source package: [libjpeg-turbo]
Details (2)
- 1:2.1.5-2 · amd64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
- 1:2.1.5-2 · arm64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
[libturbojpeg0-dev]Not affected
Source package: [libjpeg-turbo]
Details (2)
- 1:2.1.5-2 · amd64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
- 1:2.1.5-2 · arm64 · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
[libturbojpeg-java]Not affected
Source package: [libjpeg-turbo]
Details (2)
- 1:2.1.5-2 · all · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm
- 1:2.1.5-2 · all · bookworm
  Not affected
  dsa · libjpeg-turbo · debian · bookworm

Observed: Oct 23, 2026, 5:56:12 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]