CVE-2013-6629: The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google...

Security readout for executives and security teams

This is an old JPEG parsing memory-disclosure flaw. A crafted JPEG could make affected image-processing software expose sensitive data from uninitialized memory. The issue matters most where systems automatically process untrusted images, such as uploads, document conversion, or browser-rendered content. Exposure is likely through applications, browsers, converters, or services that use vulnerable libjpeg/libjpeg-turbo code and parse attacker-supplied JPEGs. The bundle does not provide complete product coverage, so dependency inventory is required. Treat as a moderate remediation item unless a critical service processes untrusted images at scale. It is a data exposure risk, not documented here as active exploitation or code execution. Mitigation focus: Apply vendor updates for affected libjpeg, libjpeg-turbo, browser, Ghostscript, and OS packages.; Upgrade Chrome beyond 31.0.1650.48 or to a current supported release.; Prioritize systems that process public uploads, email attachments, documents, or web-sourced JPEGs..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.