# CVE-2019-2201: libjpeg-turbo8: In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missin...

CVE-2019-2201 is fixed in 4 products on 1 platform, first by libjpeg-turbo-progs 1.5.2-0ubuntu5.18.04.3, released November 6, 2019. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2019-2201
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0246
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 6, 2019

## Description

In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libjpeg-turbo-progs Ubuntu 18.04.6 LTS (bionic) | 1.5.2-0ubuntu5.18.04.3 | [libjpeg-turbo-progs 1.5.2-0ubuntu5.18.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjpeg-turbo-progs-1.5.2-0ubuntu5.18.04.3.md) | Nov 6, 2019 |
| Linux | libjpeg-turbo-test Ubuntu 18.04.6 LTS (bionic) | 1.5.2-0ubuntu5.18.04.3 | [libjpeg-turbo-test 1.5.2-0ubuntu5.18.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjpeg-turbo-test-1.5.2-0ubuntu5.18.04.3.md) | Nov 6, 2019 |
| Linux | libjpeg-turbo8 Ubuntu 18.04.6 LTS (bionic) | 1.5.2-0ubuntu5.18.04.3 | [libjpeg-turbo8 1.5.2-0ubuntu5.18.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjpeg-turbo8-1.5.2-0ubuntu5.18.04.3.md) | Nov 6, 2019 |
| Linux | libturbojpeg Ubuntu 18.04.6 LTS (bionic) | 1.5.2-0ubuntu5.18.04.3 | [libturbojpeg 1.5.2-0ubuntu5.18.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libturbojpeg-1.5.2-0ubuntu5.18.04.3.md) | Nov 6, 2019 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo