CVE-2021-45928

Name of the Vulnerable Software and Affected Versions: libjxl versions prior to 0.6 libvips versions 8.11 through 8.11.2

Description: The issue is an out-of-bounds write in jxl::ModularFrameDecoder::DecodeGroup, which is called from jxl::FrameDecoder::ProcessACGroup and jxl::ThreadPool::RunCallState<jxl::FrameDecoder::ProcessSections>.

Recommendations: For libjxl versions prior to 0.6, update to version 0.6 or later. For libvips versions 8.11 through 8.11.2, consider updating to a version that incorporates the fixed libjxl version.