CVE-2023-2804

CVE-2023-2804 is a heap-based buffer overflow in libjpeg-turbo's h2v2_merged_upsample_internal() function, specifically impacting 12-bit data precision. An attacker can craft a malicious 12-bit lossless JPEG image with out-of-range samples, leading to a denial of service (application crash) via a segmentation fault or buffer overflow when decompressed. This vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity requiring user interaction, primarily impacting availability. There is no evidence of active exploitation, public exploit code, or inclusion in the KEV catalog, though it has garnered significant community discussion and media coverage.