Ubuntu compression library CVE-2026-52050

MEDIUM

2026-08-13 vendor:ubuntu

Severity by source

vuln.today AI

5.9 MEDIUM

Network vector if library processes remote input; high complexity because OOM must be attacker-induced; availability-only impact from crash.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 17:39 vuln.today

DescriptionCVE.org

[precompute_slide_window NULL deref on OOM / more_comps NULL deref after failed calloc / bi_initialize / alloc NULL deref on OOM]

AnalysisAI

Null pointer dereferences triggered by out-of-memory conditions affect a compression or codec library packaged by Ubuntu, impacting functions precompute_slide_window, more_comps (after failed calloc), and bi_initialize/alloc. Exploitation of these conditions can cause process crashes, resulting in denial of service for any application that processes attacker-supplied data through the affected library. No active exploitation is confirmed; no CVSSv3 score or CWE classification has been assigned at time of analysis.

Technical ContextAI

The vulnerability class is NULL pointer dereference arising from unhandled memory allocation failures (OOM conditions). The function names suggest a sliding-window compression algorithm (precompute_slide_window), a multi-component data structure (more_comps - consistent with image codecs such as JPEG which have per-channel components), and bit-level buffer initialization (bi_initialize). When calloc or alloc return NULL due to exhausted heap memory, the code proceeds to dereference the NULL pointer rather than returning an error, causing a segmentation fault. No CWE has been assigned, but this pattern maps to CWE-476 (NULL Pointer Dereference) driven by CWE-252 (Unchecked Return Value). No CPE strings were provided, so the exact affected package cannot be confirmed from this data alone.

Affected ProductsAI

The affected product is a compression or image-processing library distributed via Ubuntu, identified only by the Ubuntu vendor report. No CPE strings, specific package name, or version range were provided in the available intelligence. The exact Ubuntu release series affected is not stated in the available data. Analysts should cross-reference the Ubuntu Security Notices (USN) feed and Ubuntu CVE Tracker at ubuntu.com/security/CVE-2026-52050 for authoritative package and version information.

RemediationAI

No vendor patch version or advisory URL was provided in the available intelligence data. Because this is reported by Ubuntu, the primary remediation path is to monitor the Ubuntu Security Notices (USN) feed and apply the updated package via the standard apt upgrade mechanism once a fix is published. Until a patch is available, mitigations should focus on restricting the attack surface: if the affected library is used to process untrusted input from a network source, consider applying input size limits or sandboxing the processing process (e.g., via seccomp or a dedicated low-privilege worker) so that a crash does not affect the broader service. Restricting who can supply data to the vulnerable code path limits exploitation opportunity. No exact fix version can be cited as none was confirmed in the available data.