Out of bounds Copy in Libjxl in large image groups

An attacker could exploit this vulnerability by providing a specially crafted JPEG XL image to an application using libjxl for decoding. The image's size, combined with the order in which groups are processed during multi-threaded decoding, can trigger an out-of-bounds write to the heap. This can overwrite critical memory regions, potentially leading to application crashes, arbitrary code execution, or other unpredictable behavior. The impact is particularly concerning in environments where libjxl is used to process untrusted image data, such as web servers or image processing pipelines. While the description doesn't explicitly mention remote code execution, heap overflows can often be leveraged for such attacks, depending on the surrounding code and memory layout.

Applications and systems that rely on libjxl to decode JPEG XL images are at risk. This includes image processing software, web servers serving JPEG XL content, and embedded devices using libjxl for image handling. Systems that process user-uploaded images are particularly vulnerable, as they are more likely to encounter malicious files.

• linux / server: Monitor libjxl process memory usage for unusual spikes during image decoding. Use lsof or ss to identify processes using libjxl and investigate any suspicious network connections.

lsof -p $(pidof libjxl)

• generic web: Examine web server access logs for requests containing JPEG XL images with unusually large file sizes. Check error logs for any crashes or exceptions related to libjxl during image processing.

grep 'libjxl' /var/log/nginx/error.log

1. 2021-11-01Disclosure

   disclosure

1. आरक्षित2021-01-05
2. प्रकाशित2021-11-01
3. संशोधित2024-09-17
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2021-22564 is to upgrade to a patched version of libjxl. The vendor has not specified a fixed version, but upgrading to the latest available release is recommended. If upgrading is not immediately feasible, consider implementing input validation to reject JPEG XL images with sizes that could trigger the vulnerability. While a WAF or proxy cannot directly prevent this vulnerability, they can be configured to block known malicious JPEG XL files or patterns. There are no specific Sigma or YARA rules available for this vulnerability at this time, but monitoring memory usage and heap activity during image decoding can help detect potential exploitation attempts. After upgrading, confirm the fix by attempting to decode a known malicious JPEG XL image (if available) and verifying that no crash or unexpected behavior occurs.