A heap-based buffer-overflow was found in libjpeg-turbo. The upstream project describes this issue as follows:

"12-bit is the only data precision for which the range of the sample data type exceeds the valid sample range, so it is possible to craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. Attempting to decompress such an image using color quantization or merged upsampling ... caused segfaults or buffer overruns when those algorithms attempted to use the out-of-range sample values as array indices."