CVE-2026-75466: libjpeg-turbo PNG Loader DoS Vulnerability

CVE-2026-75466 is a denial of service vulnerability in libjpeg-turbo 3.2.0 affecting the PNG loader. An integer division-by-zero flaw causes application crashes when processing certain PNG images. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-75466 Overview

CVE-2026-75466 is a division-by-zero vulnerability in libjpeg-turbo 3.2.0. The flaw resides in the PNG loader path invoked by tj3LoadImage12() and tj3LoadImage16(). When these functions process a valid indexed-color PNG that carries a non-gray palette using the default pixel format, execution reaches alloc_sarray() with a zero divisor. The resulting SIGFPE terminates the process and produces a denial-of-service condition.

Critical Impact
Attackers can crash any application that uses libjpeg-turbo 3.2.0 to load untrusted PNG images through the 12-bit or 16-bit TurboJPEG image loaders.

Affected Products

libjpeg-turbo 3.2.0
Applications linking the TurboJPEG API and calling tj3LoadImage12()
Applications linking the TurboJPEG API and calling tj3LoadImage16()

Discovery Timeline

2026-08-26 - CVE-2026-75466 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75466

Vulnerability Analysis

The vulnerability affects the 12-bit and 16-bit variants of the TurboJPEG image loader when they process PNG input. Both tj3LoadImage12() and tj3LoadImage16() funnel indexed-color PNG data through the shared decoding path. When the source image uses a non-gray palette and the caller requests the default pixel format, an internal dimension calculation resolves to zero. That zero value is later used as a divisor inside alloc_sarray(), raising SIGFPE and aborting the calling process.

Because libjpeg-turbo underpins image handling in operating systems, browsers, imaging utilities, thumbnail services, and server-side conversion pipelines, any component that accepts user-supplied PNGs through the affected loaders inherits the crash primitive. The result is a reliable denial of service rather than memory corruption.

Root Cause

The defect is an integer division-by-zero in alloc_sarray() reached during PNG palette handling. The loader does not validate that the derived samples-per-row value is non-zero before it is used as the divisor. Indexed-color PNGs with a non-gray palette exercise the code path when the caller relies on the default pixel format selection.

Attack Vector

An attacker crafts an indexed-color PNG containing a non-gray palette and delivers it to any application that decodes images with tj3LoadImage12() or tj3LoadImage16(). Delivery vectors include file uploads, email attachments, web content, and automated conversion services. No authentication, memory corruption, or code execution is required to trigger the crash. Refer to the upstream GitHub Issue #911 for reproducer details.

// No verified exploit code is published. See upstream issue #911
// for the proof-of-concept PNG and stack trace.

Detection Methods for CVE-2026-75466

Indicators of Compromise

Repeated SIGFPE (signal 8) terminations in processes that link libjpeg-turbo 3.2.0.
Core dumps whose faulting frame includes alloc_sarray called from a tj3LoadImage12 or tj3LoadImage16 path.
Spikes in image-processing worker restarts correlated with untrusted PNG uploads.

Detection Strategies

Inventory binaries and containers that ship libjpeg-turbo 3.2.0 shared objects, and flag those exposing PNG ingestion to untrusted input.
Alert on process crash telemetry where the terminating signal is SIGFPE and the parent is an image-conversion, thumbnailing, or upload service.
Correlate web-facing upload logs with backend worker crashes to identify weaponized PNG submissions.

Monitoring Recommendations

Monitor auditd, systemd, or container runtime logs for repeated abnormal termination of image workers.
Track PNG uploads that fail post-validation but succeed pre-validation to identify decoder-triggered failures.
Retain crash artifacts (core dumps, stack traces) for services that call the TurboJPEG API for post-incident analysis.

How to Mitigate CVE-2026-75466

Immediate Actions Required

Identify all applications and containers that bundle libjpeg-turbo 3.2.0 and process PNG input.
Restrict PNG uploads or disable the 12-bit and 16-bit TurboJPEG loader entry points where feasible until a patched build is deployed.
Sandbox or isolate image-decoding workers so a SIGFPE cannot cascade into broader service downtime.

Patch Information

No fixed version is listed in the NVD record at the time of publication. Track the upstream GitHub Issue #911 for patch commits and rebuild downstream packages once a corrected release is published.

Workarounds

Reject indexed-color PNGs at the application layer before they reach tj3LoadImage12() or tj3LoadImage16().
Request an explicit pixel format from the TurboJPEG API instead of relying on the default when loading 12-bit or 16-bit images.
Run image conversion in a supervised worker that auto-restarts on SIGFPE to preserve service availability.

bash

# Example: identify processes linked against vulnerable libjpeg-turbo
lsof 2>/dev/null | grep -E 'libturbojpeg\.so|libjpeg\.so' | awk '{print $1, $2, $9}' | sort -u

# Example: verify installed package version
dpkg -l | grep libjpeg-turbo   # Debian/Ubuntu
rpm -qa | grep libjpeg-turbo   # RHEL/Fedora