CVE-2024-11498: Resource exhaustion via Stack overflow in libjxl
There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11498?
CVE-2024-11498 is considered a high-severity vulnerability due to the potential for stack overflow and excessive memory usage.
How do I fix CVE-2024-11498?
To remediate CVE-2024-11498, it is recommended to update libjxl to a version that addresses the stack buffer overflow issue.
What are the risks associated with CVE-2024-11498?
Exploiting CVE-2024-11498 can lead to denial of service by exhausting stack memory, which may crash the application using the JPEG XL decoder.
Which versions of libjxl are affected by CVE-2024-11498?
CVE-2024-11498 affects libjxl versions prior to the fix included in the updates following commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.
Can CVE-2024-11498 be exploited remotely?
Yes, CVE-2024-11498 can potentially be exploited remotely by an attacker sending a specially-crafted JPEG XL file.