Riskcovery

CVE-2024-11498

Resource exhaustion via Stack overflow in libjxl

State
Published
Severity
6.9 Medium
Published
Nov 25, 2024
Updated
Nov 25, 2024
Reserved
Nov 20, 2024

Read the record on cve.org

Description

There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:HGoogle

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
libjxllibjxl
  • 0.11.0 to before 65fbec56bc578b6b6ee02a527be70787bbd053b0Affected
  • 0.10.0-2 to before 65fbec56bc578b6b6ee02a527be70787bbd053b0Affected
  • 0.9.0-3 to before 65fbec56bc578b6b6ee02a527be70787bbd053b0Affected
  • 0.8.0-3 to before 65fbec56bc578b6b6ee02a527be70787bbd053b0Affected
  • 0.7.0-1 to before 65fbec56bc578b6b6ee02a527be70787bbd053b0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.