Can a JPEG image contain a virus?
Practically no. A JPEG is pixel data and the image viewers that decode it are heavily tested; real exploits through image files are rare and short-lived. The common trick is a file named .jpg that is not a JPEG at all.
How a .JPG file can do harm
- Exploits for specific decoder bugs, which appear occasionally and are patched quickly; an up-to-date OS is not meaningfully at risk
- Hidden data (steganography) in the pixels or metadata, which is a way to smuggle information, not to attack the viewer
- A payload appended after the image data, which does nothing by itself but can be extracted by a program already running on the machine
- Scripts in metadata that some old web applications executed when they processed uploads; a server-side problem, not a viewer one
What it cannot do
- Run code in a current image viewer, browser or photo app
- Infect a machine by being viewed, downloaded or thumbnailed under normal circumstances
Signs of a suspicious .JPG file
- A .jpg file the detector identifies as an executable, script, HTML or archive
- A photo attachment that Windows wants to run rather than display, or that asks for permissions
- A double extension such as photo.jpg.exe
- A file far larger than its dimensions justify, which may be appended data
Before you open it
- Show file extensions so a disguised executable is visible
- Check the real type: a JPEG starts with FF D8 FF; anything else is not a JPEG
- Keep the operating system updated; decoder bugs are fixed in system libraries
- Strip metadata before publishing photos to avoid leaking location and device details, which is a privacy rather than a malware issue
Check that it really is a .JPG file
The first question for any suspicious file is whether it is what its name says. Drop it on the detector: it reads the bytes in your browser, reports the real type, and computes the SHA-256 you can look up on VirusTotal, all without the file leaving your machine. A common JPEG signature is FF D8 FF; see the signature reference.