In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14153
Reference (s):
- http://www.ijg.org/files/jpegsrc.v9d.tar.gz
- https://bugs.gentoo.org/727908
- https://github.com/libjpeg-turbo/libjpeg-turbo/issues/445