CVE-2024-11498: libjxl_project libjxl Uncontrolled Resource Consumption
Vulnerability summary
CVE-2024-11498 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in libjxl_project libjxl. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 8 · Related 6Timeline
- 25-11-2024PublishedVulnerability first disclosed.
- 25-11-2024Last modifiedVulnerability information updated.
Description
There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.60% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse2 products
- libjxl&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 0.10.3-150700.4.9.1
- libjxl&distro=SUSE Package Hub 15 SP5< 0.8.2-bp155.2.6.1
Debian1 product
- jpeg-xl< 0.7.0-10+deb12u1 | < 0.10.4-2
Libjxl1 product
- libjxl≥ 0.11.0, < 65fbec56bc578b6b6ee02a527be70787bbd053b0 | ≥ 0.10.0-2, < 65fbec56bc578b6b6ee02a527be70787bbd053b0 | ≥ 0.9.0-3, < 65fbec56bc578b6b6ee02a527be70787bbd053b0 | ≥ 0.8.0-3, < 65fbec56bc578b6b6ee02a527be70787bbd053b0 | ≥ 0.7.0-1, < 65fbec56bc578b6b6ee02a527be70787bbd053b0
Libjxl_project1 product
- libjxl< 0.8.4
Opensuse1 product
- libjxl&distro=openSUSE Leap 15.5< 0.8.2-bp155.2.6.1
Ubuntu1 product
- jpeg-xl< 0.7.0-10.2ubuntu6.1
6 vendors · 7 products
References
9 links- lists.opensuse.org/archives/…Advisory
