CVE-2023-2804
Medium CVSS 6.5Published 2023-05-25 ยท last changed 2026-06-17
The fix
Microsoft fixes this in updateKB5075897. The fixed build differs per Windows version, so the row that matters is the one matching the machine you are looking at.
| Windows version | Fixed in build | Update | Released |
|---|---|---|---|
| Windows Server 2022, 23H2 Edition (Server Core installation) | 10.0.25398.2149 | KB5075897 | 2026-09-20 |
Having the KB is not the same as knowing whether a machine has it. Windows updates supersede each other, so the update you installed often covers a fix that shipped in an earlier one. Paste your build into the patch checker and it walks that chain for you.
What it is
A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.
Sources
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H