CVE-2021-45928: Libjxl Project Libjxl

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

libjxl b02d6b9, as used in libvips 8.11 through 8.11.2 and other products, has an out-of-bounds write in jxl::ModularFrameDecoder::DecodeGroup (called from jxl::FrameDecoder::ProcessACGroup and jxl::ThreadPool::RunCallState<jxl::FrameDecoder::ProcessSections).

Affected products

• Libjxl Project Libjxl: before 0.6.1 (fixed in 0.6.1)

Published 2022-01-01. Last modified 2026-06-17.