CVE-2023-0645
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
An out-of-bounds read vulnerability exists in libjxl. An attacker can cause an out-of-bounds read in the EXIF handler by using a specially crafted file.
Risk Assessment
The risk involves potential disclosure of sensitive memory data or application instability when processing a malicious image file with libjxl.
Recommendation
Upgrade libjxl to version 0.8.1 or apply the fix commit referenced in the CVE description immediately.
Original NVD description (English source)
An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. We recommend upgrading to version 0.8.1 or past commit https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159 https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159