CVE-2021-22563— Memory Overread in libjxl
Quick assessment
Affected
Google LLC libjxl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Github libjxl是一个PEG XL（编码器和解码器）的参考实现。 libjxl 存在缓冲区错误漏洞，该漏洞源于当渲染样条时，使用libjxl的无效JPEG XL图像可能会导致对std::vector<std::vector<T>>的越界访问。OOB读访问可能导致段错误，或者基于其他进程内存渲染样条。
Possible ATT&CK Techniques 1 AI
T1200 · Hardware Additions
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-22563
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Memory Overread in libjxl
Source: CVE Program / CVE List V5
Vulnerability Description
Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering splines. The OOB read access can either lead to a segfault, or rendering splines based on other process memory. It is recommended to upgrade past 0.6.0 or patch with https://github.com/libjxl/libjxl/pull/757
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
缓冲区上溢读取
Source: CVE Program / CVE List V5
Vulnerability Title
Github libjxl 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Github libjxl是一个PEG XL（编码器和解码器）的参考实现。 libjxl 存在缓冲区错误漏洞，该漏洞源于当渲染样条时，使用libjxl的无效JPEG XL图像可能会导致对std::vector<std::vector<T>>的越界访问。OOB读访问可能导致段错误，或者基于其他进程内存渲染样条。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Google LLC | libjxl | unspecified ~ 0.6.0 | - |
|
II. Public POCs for CVE-2021-22563
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-22563
请登录查看更多情报信息。
Patches & Fixes for CVE-2021-22563 (1)
-
https://github.com/libjxl/libjxl/pull/757 x_refsource_MISC
Other References for CVE-2021-22563 (1)
-
https://github.com/libjxl/libjxl/issues/735 x_refsource_MISC
IV. Related Vulnerabilities
Same product: libjxl
-
CVE-2026-82522
libjxl < 0.12.0 Container Box Parser Integer Underflow via 3 -
CVE-2025-12474
libjxl: Uninitialized memory read in decoder due to incorrec -
CVE-2026-1837
libjxl: Out-of-bounds write in grayscale color transformatio -
CVE-2024-11403
Out of Bounds Memory Read/Write in libjxl -
CVE-2024-11498
Resource exhaustion via Stack overflow in libjxl
Same vendor: Google LLC
-
CVE-2022-3095
Incorrect parsing of the backslash characters in Dart librar -
CVE-2022-3474
Bazel leaks user credentials through the remote assets API -
CVE-2022-3421
Privilege escalation in Google Drive for Desktop on MacOS -
CVE-2022-3171
Memory handling vulnerability in ProtocolBuffers Java core a -
CVE-2022-1941
Out of Memory issue in ProtocolBuffers for cpp and python
V. Comments for CVE-2021-22563
No comments yet