Red Hat, Inc. CVE-2023-2804: Heap Based Overflow libjpeg-turbo
CVE-2023-2804 is fixed in Windows Server 2022, 23H2 Edition (Server Core installation) on 1 platform by KB5075897 (version 25398.2149), released February 10, 2026. It is not reported as exploited. Patch Radar priority: Routine.
<p>A heap‑based buffer overflow exists in libjpeg‑turbo’s h2v2_merged_upsample_internal() function when processing 12‑bit lossless JPEG images. An attacker could craft an image containing out‑of‑range 12‑bit samples that, when decompressed with merged upsampling enabled, may trigger a segmentation fault or buffer overflow, resulting in an application crash.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Microsoft | |||
| Windows Server 2022, 23H2 Edition (Server Core installation) | 25398.2149 | KB5075897 | Feb 10, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.