CVE-2021-36692

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). When encoding a malicous APNG file using cjxl, an attacker can trigger a denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-369

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/libjxl/libjxl/commit/7dfa400ded53919d986c5d3d23446a09e0cf481bPatch, Third Party Advisory
https://github.com/libjxl/libjxl/issues/308Exploit, Issue Tracking, Third Party Advisory
https://github.com/libjxl/libjxl/pull/313Patch, Third Party Advisory
https://github.com/libjxl/libjxl/commit/7dfa400ded53919d986c5d3d23446a09e0cf481bPatch, Third Party Advisory
https://github.com/libjxl/libjxl/issues/308Exploit, Issue Tracking, Third Party Advisory
https://github.com/libjxl/libjxl/pull/313Patch, Third Party Advisory

Timeline

Published: Aug 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-366955.4Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in the downl CVE-2021-366965.4Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social me CVE-2021-366976.7With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess CVE-2021-366985.4Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name.CVE-2021-36706.5MaxQueryDuration not honoured in Samba AD DC LDAP CVE-2021-367019.1In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. The vulnerability may allow CVE-2021-367026.1The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting CVE-2021-367036.1The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerabi CVE-2021-367059.8In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contain CVE-2021-367069.8In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD cont CVE-2021-367079.8In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff c CVE-2021-367087.5In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset the password to the adm