CVE-2018-20330: Integer Overflow
Last updated 25 August 2025
Other sources
The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because multiplication of pitch and height is mishandled, as demonstrated by tjbench.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-20330?
CVE-2018-20330 is a vulnerability in libjpeg-turbo 2.0.1 that allows an integer overflow leading to a heap-based buffer overflow when processing BMP images.
What is the severity of CVE-2018-20330?
CVE-2018-20330 has a severity rating of 8.8, which is classified as high.
How does CVE-2018-20330 affect software?
CVE-2018-20330 affects libjpeg-turbo 2.0.1 and potentially other versions as well.
What is the recommended remedy for CVE-2018-20330 in debian?
For debian users, the recommended remedy for CVE-2018-20330 is to update to version 1:1.5.2-2+deb10u1, 1:2.0.6-4, or 1:2.1.5-2 of libjpeg-turbo.
What is the recommended remedy for CVE-2018-20330 in ubuntu?
For ubuntu users, the recommended remedy for CVE-2018-20330 is to update to version 2.0.1-0ubuntu2.2 (disco) or 2.0.2-0ubuntu1 (eoan) of libjpeg-turbo.