CVE-2026-35591: Missing Jpeg Component Validationcve-2026-35591-missing-jpeg-component-validation
Missing validation of `output_components` after determining image dimensions. When calculating output buffer dimension allocations downstream of `jpeg_calc_output_dimensions`, the actual decoded `$CINFO->output_components` must be validated against expected bytes per pixel or buffer channels. Missing this validation allows malicious files with mismatched con
