CVE-2021-28026

2021-03-0514:15:13

Google

osv.dev

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.6%

JSON

jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can trigger arbitrary code execution or a denial of service.

CPENameOperatorVersion
jpeg-xleq0.3.1
jpeg-xleq0.2
jpeg-xleq0.3
jpeg-xleq0.3.2
jpeg-xleq0.1.1
jpeg-xleq0.1

Name	Operator	Version
jpeg-xl	eq	0.3.1
jpeg-xl	eq	0.2
jpeg-xl	eq	0.3
jpeg-xl	eq	0.3.2
jpeg-xl	eq	0.1.1
jpeg-xl	eq	0.1

References

gitlab.com/wg1/jpeg-xl/-/issues/163