This vulnerability arises from missing bounds checking in cupoch's libjpeg‑turbo module, allowing an out‑of‑bounds write when processing tjbench.C files. The write can corrupt memory, potentially granting an attacker the ability to execute arbitrary code, cause denial of service, or disclose confidential data, consistent with CWE‑787.

The issue affects the cupoch project maintained by neka‑nat. It specifically targets the libjpeg‑turbo components used by cupoch when handling tjbench.C inputs. No version range is supplied, so all releases using the affected code path may be vulnerable until a patch is applied.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% and absence from CISA's KEV list suggest exploitation is currently unlikely, but the vulnerability remains exploitable if an attacker can influence input to the vulnerable module. The attack vector is not explicitly documented; based on the description of tjbench.C processing, it is inferred that an attacker could trigger the write by supplying crafted tjbench.C data or by manipulating file handling routines.