CVE-2023-35790
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
An issue was discovered in libjxl before version 0.8.2 in dec_patch_dictionary.cc. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop.
Risk Assessment
The organization may experience service outages due to an infinite loop, which can impact operations and user satisfaction.
Recommendation
It is recommended to update the libjxl library to version 0.8.2 or later to mitigate this vulnerability.
Other vulnerabilities in libjxl
See all- CVE-2026-52584High
Buffer overflow vulnerability in libjxl library version 0.11.2 and earlier in the DecodeImageAPNG function. A local attacker can exploit this to obtain sensitive information.
- CVE-2026-1837High
A specially crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory, and then data from another uninitialized region is copied to pixel data. This occurs during color transformation of grayscale images to another grayscale color space when using the LCMS2 CMS engine.
- CVE-2023-0645Medium
An out-of-bounds read vulnerability exists in libjxl. An attacker can cause an out-of-bounds read in the EXIF handler by using a specially crafted file.
Original NVD description (English source)
An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop.