CVE-2024-11403 Out of Bounds Memory Read/Write in libjxl

What is CVE-2024-11403?

CVE-2024-11403 is a medium-severity memory corruption vulnerability in libjxl, published on 25 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.

Weakness: CWE-787, CWE-125

Which versions are affected by CVE-2024-11403?

It affects 1 product.

Products include Libjxl Project Libjxl.

How do I fix CVE-2024-11403?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-11403 being exploited?

There is no known exploitation of CVE-2024-11403 in the wild and no public exploit code.

Other vulnerabilities in libjxl

• CVE-2021-27804 Memory corruption in n/a Critical 9.8
• CVE-2026-1837 libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2 High 8.7
• CVE-2023-35790 Integer overflow in n/a High 7.5
• CVE-2021-36691 Denial of service in n/a High 7.5
• CVE-2024-11498 Resource exhaustion via Stack overflow in libjxl Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2024-11403, GHSA-5pp5-4vfv-784q, SUSE-SU-2025:01883-1, UBUNTU-CVE-2024-11403, openSUSE-SU-2024:0402-1.