Skip to content
OpenAdvisories
Medium DSA-5958-1 4 CVEs

jpeg-xl - security update

Published Jul 4, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 12 jpeg-xl 0.7.0-10+deb12u1

Vulnerabilities 4

  • Medium 6.9
    CVE-2024-11403

    Out of Bounds Memory Read/Write in libjxl

    There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not…

    libjxl libjxl jpeg-xl jpeg-xl Debian Ubuntu Alpine
  • Medium 6.9
    CVE-2024-11498

    Resource exhaustion via Stack overflow in libjxl

    There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will caus…

    libjxl libjxl jpeg-xl jpeg-xl Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2023-0645

    Out of Bounds read in libjxl

    An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. We recommend upgrading to version 0.8.1 or past commit  https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c182…

    libjxl libjxl jpeg-xl jpeg-xl Debian Ubuntu
  • Unscored —
    CVE-2023-35790

    An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2. An integer underflow in patch decoding can l…

    jpeg-xl jpeg-xl Debian Ubuntu