CVE-2021-28026: Jpeg Jpeg-Xl

High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days.

jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation. When decoding a malicous jxl file using djxl, an attacker can trigger arbitrary code execution or a denial of service.

Affected products

• Jpeg Jpeg-Xl: version 0.3.2 only

Published 2021-03-05. Last modified 2026-06-17.