A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.

The remote Windows host is missing security update 5075897. It is, therefore, affected by multiple vulnerabilities

  - A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal()     function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which     the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit     lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress     such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an     application to crash. (CVE-2023-2804)

  - Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security     feature over a network. (CVE-2026-21513)

  - Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an     authorized attacker to elevate privileges locally. (CVE-2026-21519)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal()
    function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which
    the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit
    lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress
    such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an
    application to crash. (CVE-2023-2804)

ID	Name	Product	Family	Severity
298558	KB5075897: Windows Server version 23H2 Security Update (February 2026)	Nessus	Windows : Microsoft Bulletins	high
424075	Alpine: multiple libjpeg-turbo packages: security update to 2.1.5.1-r4	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
424075	Alpine: multiple libjpeg-turbo packages: security update to 2.1.5.1-r4	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
405221	Alpine: libjpeg-turbo: security update to 2.1.5.1-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405221	Alpine: libjpeg-turbo: security update to 2.1.5.1-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400084	Alpine: multiple libjpeg-turbo packages: security update to 2.1.5.1-r3 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400084	Alpine: multiple libjpeg-turbo packages: security update to 2.1.5.1-r3 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium

Detections

Analytics

CVE-2023-2804

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium