Platform
c
Component
libjxl
Fixed in
0.6.1
CVE-2021-22564 describes an out-of-bounds write vulnerability discovered in libjxl, a JPEG XL image codec library. This flaw allows a malicious actor to craft a JPEG XL image that, when decoded, can trigger a heap buffer overflow, potentially leading to a denial-of-service condition. The vulnerability affects versions of libjxl up to and including 0.6.0. Users are strongly advised to upgrade to a patched version of libjxl to address this security concern.
An attacker could exploit this vulnerability by providing a specially crafted JPEG XL image to an application using libjxl for decoding. The image's size, combined with the order in which groups are processed during multi-threaded decoding, can trigger an out-of-bounds write to the heap. This can overwrite critical memory regions, potentially leading to application crashes, arbitrary code execution, or other unpredictable behavior. The impact is particularly concerning in environments where libjxl is used to process untrusted image data, such as web servers or image processing pipelines. While the description doesn't explicitly mention remote code execution, heap overflows can often be leveraged for such attacks, depending on the surrounding code and memory layout.
CVE-2021-22564 was publicly disclosed on November 1, 2021. There is no indication of active exploitation campaigns targeting this vulnerability. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are not widely available, suggesting a relatively low probability of near-term exploitation, but the potential for heap-based attacks remains a concern.
Exploit Status
EPSS
0.04% (13% percentile)
CVSS Vector
The primary mitigation for CVE-2021-22564 is to upgrade to a patched version of libjxl. The vendor has not specified a fixed version, but upgrading to the latest available release is recommended. If upgrading is not immediately feasible, consider implementing input validation to reject JPEG XL images with sizes that could trigger the vulnerability. While a WAF or proxy cannot directly prevent this vulnerability, they can be configured to block known malicious JPEG XL files or patterns. There are no specific Sigma or YARA rules available for this vulnerability at this time, but monitoring memory usage and heap activity during image decoding can help detect potential exploitation attempts. After upgrading, confirm the fix by attempting to decode a known malicious JPEG XL image (if available) and verifying that no crash or unexpected behavior occurs.
Upgrade the libjxl library to a version later than 0.6.0. Alternatively, apply the patch provided at https://github.com/libjxl/libjxl/pull/775 to fix the vulnerability.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2021-22564 is a medium severity vulnerability in libjxl versions up to 0.6.0 that allows a crafted JPEG XL image to trigger a heap buffer overflow, potentially leading to denial of service.
You are affected if you are using libjxl version 0.6.0 or earlier and process untrusted JPEG XL images.
Upgrade to a patched version of libjxl. Consult the libjxl project's website for the latest release and instructions.
There is currently no evidence of active exploitation campaigns targeting CVE-2021-22564.
Refer to the libjxl project's security advisories or GitHub repository for updates and information related to CVE-2021-22564.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.