CVE-2021-28026

Published: Mar 5, 2021Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can trigger arbitrary code execution or a denial of service.

Affected (1)

Products: Jpeg: Jpeg Xl

Jpeg

1 product

Jpeg Xl

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jpeg Jpeg Xl	Version 0.3.2

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (2)

https://gitlab.com/wg1/jpeg-xl/-/issues/163

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://gitlab.com/wg1/jpeg-xl/-/issues/163

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.