PT-2021-17714 · Jpeg-Xl · Jpeg-Xl
5N1P3R0010
·
Published
2021-03-05
·
Updated
2021-03-09
·
CVE-2021-28026
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
jpeg-xl version 0.3.2
Description:
The issue is related to a heap buffer overflow in the
/lib/jxl/coeff order.cc file, specifically in the ReadPermutation function. This can be triggered when decoding a malicious jxl file using djxl, potentially allowing an attacker to execute arbitrary code or cause a denial of service.Recommendations:
For jpeg-xl version 0.3.2, consider avoiding the use of the
ReadPermutation function in the /lib/jxl/coeff order.cc file until a patch is available. As a temporary workaround, restrict the decoding of jxl files using djxl to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jpeg-Xl