https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-29390.htmlhttps://patchthecve.com/cve/CVE-2021-29390.htmlWed, 17 Jun 2026 03:47:34 +0000HIGH 7.1: libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.https://patchthecve.com/cve/CVE-2023-2804.htmlhttps://patchthecve.com/cve/CVE-2023-2804.htmlWed, 17 Jun 2026 05:53:28 +0000MEDIUM 6.5: A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could chttps://patchthecve.com/cve/CVE-2020-35538.htmlhttps://patchthecve.com/cve/CVE-2020-35538.htmlWed, 17 Jun 2026 03:13:53 +0000MEDIUM 5.5: A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.https://patchthecve.com/cve/CVE-2021-46822.htmlhttps://patchthecve.com/cve/CVE-2021-46822.htmlWed, 17 Jun 2026 04:15:37 +0000MEDIUM 5.5: The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.