CVE-2021-28026

jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can trigger arbitrary code execution or a denial of service.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

1.17% chance of exploitation in the next 30 days, 65th percentile

Published

2021-03-05

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://gitlab.com/wg1/jpeg-xl/-/issues/163

References

• CVE Record
• NVD entry

Related

• CVE-2021-28021
• CVE-2021-28040
• CVE-2021-28007
• CVE-2021-28060
• CVE-2021-28006
• CVE-2021-28070