CVE-2020-13790: Libjpeg-Turbo

High severity, CVSS 8.1. EPSS: 3.2% chance of exploitation in the next 30 days.

libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.

Affected products

• Libjpeg-Turbo Libjpeg-Turbo: version 2.0.4 only
• Mozilla Mozjpeg: version 4.0.0 only

Published 2020-06-03. Last modified 2026-06-17.