CyberRota Analysis
AI-GeneratedThe vulnerability exists in libjxl prior to version 0.12, where an integer underflow in the container box parser allows remote attackers to inject arbitrary metadata into JPEG XL files. This can lead to out-of-bounds reads and the manipulation of metadata formats such as Exif and XMP, potentially compromising the integrity of the data. Organizations utilizing libjxl for image processing should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.