CVE-2022-35166: libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.

Routine

MEDIUM 5.5DOWNGRADE

CVE-2022-35166 is a medium-severity flaw (CVSS 5.5) affecting libjpeg. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.

Why this priority

Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.5 (Medium)
Attack vector	Local
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.3% (top 78%)
CISA exploited list	No
Weakness	CWE-835
Published	2022-08-18
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: jpeg

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-08-18 05:15 UTCPublished CVE record published
2026-06-17 04:51 UTCUpdated Record last modified

jpeg libjpeg DOWNGRADE

Affected: 2022-06-15

Fixed in: no fixed release known

Safe to downgrade to: a release before 2022-06-15

1. Check installed version

apt-cache policy libjpeg || rpm -q libjpeg || libjpeg --version

2. No fixed release: DOWNGRADE to a release before 2022-06-15 (Debian / Ubuntu)

apt-cache madison libjpeg sudo apt install libjpeg=<VERSION_BEFORE_2022-06-15> sudo apt-mark hold libjpeg

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list libjpeg sudo dnf downgrade libjpeg-<VERSION_BEFORE_2022-06-15> sudo dnf versionlock add libjpeg

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-35166?

libjpeg: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2022-35166 being exploited?

CVE-2022-35166 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-35166 affect?

CVE-2022-35166 affects libjpeg. Severity is medium (CVSS 5.5). libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.

How urgent is CVE-2022-35166?

Priority 30/100. Public exploit reference

Related CVEs

CVE-2023-37837 MEDIUM 6.5 UPGRADE libjpeg commit db33a6e was discovered to contain a heap buffer overflow via LineBitmapRequester::EncodeRegion
CVE-2023-37836 MEDIUM 6.5 UPGRADE libjpeg commit db33a6e was discovered to contain a reachable assertion via BitMapHook::BitMapHook at bitmaphoo
CVE-2022-37770 MEDIUM 6.5 MITIGATE libjpeg commit 281daa9 was discovered to contain a segmentation fault via LineMerger::GetNextLowpassLine at li
CVE-2022-37769 MEDIUM 6.5 MITIGATE libjpeg commit 281daa9 was discovered to contain a segmentation fault via HuffmanDecoder::Get at huffmandecode
CVE-2022-37768 HIGH 7.5 MITIGATE libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer.

References

← Back to latest CVEs