The vulnerability in libjpeg-turbo 3.2.0 is an integer division‑by‑zero flaw in its PNG loader. When a valid indexed‑color PNG image containing a non‑gray palette is processed by tj3LoadImage12() or tj3LoadImage16() with the default pixel format, the library invokes alloc_sarray() which performs a division that can evaluate to zero. That causes a SIGFPE, terminating the application and resulting in a denial of service. The weakness corresponds to CWE-369, an unchecked division operation.

The defect is confined to libjpeg‑turbo version 3.2.0 and applies whenever applications load PNG files through tj3LoadImage12() or tj3LoadImage16(). Any software that relies on libjpeg‑turbo for image decoding—such as web servers, media players, or document processors—can be affected if the library is linked into their process.

No EPSS score or KEV listing is available, and there is no CVSS score disclosed. Based on the description, the likely attack vector is inferred to be the delivery of a malicious PNG file to an application that processes images with libjpeg‑turbo. The execution of the unsafe division operation can crash the process, allowing an attacker to cause a denial‑of‑service. Because the bug is triggered purely by the image data, the risk is high for any code that loads PNG files without additional validation.