CVE-2016-5637

The restoretqbpixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquantbypassenableflag value, which allows remote attackers to execute arbitrary code or cause a denial of service out-of-bounds write via a crafted BPG image, related to a "type confusion" issue...