PT-2024-9202

CVE-2024-11403

Published

2024-10-03

Updated

2026-03-10

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions

LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99 libjpeg (affected versions not specified) libmozjs-115-0-115.15.0-4.1 libmozjs-128-0-128.5.1-3.1 libjxl-devel-0.11.1-1.1 qt6-webengine

Description

An out-of-bounds read/write vulnerability exists in the JPEG decoder used by the JPEG XL encoder when performing JPEG recompression on untrusted input. This occurs due to improper bounds checking in the presence of incomplete codes, potentially leading to an out-of-bounds write. The same vulnerability is present in jpegli, potentially causing it to read uninitialized memory or function addresses.

Recommendations

LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99: Update to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99 or a later version. libjpeg: Update to the latest version. libmozjs-115-0-115.15.0-4.1: Update to the latest version. libmozjs-128-0-128.5.1-3.1: Update to the latest version. libjxl-devel-0.11.1-1.1: Update to the latest version. qt6-webengine: Update to the latest version.

Exploitability

Exploit

Fix

Impacts

Vendors