Read the docs
TI-2024-10566 Aliases CVE-2024-11403GHSA-5pp5-4vfv-784q

Out of Bounds Memory Read/Write in libjxl

Priority LOW 31CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00631 50th percentileScored 2026-11-07
Fix Partial libjxl (libjxl): 9cc451bRed Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libjxllibjxl0.11.0 to before 9cc451b; 0.10.0-2 to before 9cc451b; 0.9.0-3 to before 9cc451b; 0.8.0-3 to before 9cc451b; 0.7.0-1 to before 9cc451b9cc451bPatch availableCNA
  • libjxl Vendorlibjxl Affected 0.11.0 to before 9cc451b; 0.10.0-2 to before 9cc451b; 0.9.0-3 to before 9cc451b; 0.8.0-3 to before 9cc451b; 0.7.0-1 to before 9cc451b Fixed in 9cc451b Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:libjxl_project:libjxl:*:*:*:*:*:*:*:*before 0.8.4Vulnerablelibjxl
  • cpe:2.3:a:libjxl_project:libjxl:*:*:*:*:*:*:*:* Versions before 0.8.4 Vulnerable ·libjxl

Remediation

  • Fix · CNA libjxl (libjxl) Fixed in 9cc451b

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-11403
  2. 2026-10-03 Alias added: GHSA-5pp5-4vfv-784q
  3. 2026-10-27 EPSS moved to the 50th–90th percentile

References

Patch 1

  • TI-2021-09194 JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory corruption. CVSS 3.1CRITICAL 9.8
  • TI-2023-00611 Out of Bounds read in libjxl CVSS 3.1CRITICAL 9.1
  • TI-2026-01512 libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2 CVSS 4.0HIGH 8.7
  • TI-2023-17879 An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2. CVSS 3.1HIGH 7.5
  • TI-2021-14837 libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc… CVSS 3.1HIGH 7.5
  • TI-2024-10649 Resource exhaustion via Stack overflow in libjxl CVSS 4.0MEDIUM 6.9
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences