CVE-2024-11498

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
libjxllibjxl>= 0.11.0, < 65fbec56bc578b6b6ee02a527be70787bbd053b0; >= 0.10.0-2, < 65fbec56bc578b6b6ee02a527be70787bbd053b0; >= 0.9.0-3, < 65fbec56bc578b6b6ee02a527be70787bbd053b0; >= 0.8.0-3, < 65fbec56bc578b6b6ee02a527be70787bbd053b0; >= 0.7.0-1, < 65fbec56bc578b6b6ee02a527be70787bbd053b0

References

Timeline

Published
Nov 25, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-114994.9A vulnerability exists in RTU500 IEC 60870-4-104 controlled station functionality, that allows an authenticated and authorized attacker to pCVE-2024-11505.5Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through SnoCVE-2024-115018.8The Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3 via deserialization of untrCVE-2024-115025.4The Planning Center Online Giving WordPress plugin through 1.0.0 does not validate and escape some of its shortcode attributes before outputCVE-2024-115036.1The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such asCVE-2024-115048.6Input from multiple fields in Streamsoft Prestiż is not sanitized properly, leading to an SQL injection vulnerability, which might be exploiCVE-2024-115067.8IrfanView DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbCVE-2024-115077.8IrfanView DXF File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitraCVE-2024-115087.8IrfanView DXF File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitraCVE-2024-115097.8IrfanView SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exeCVE-2024-11515.5A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push CVE-2024-115107.8IrfanView WBZ plugin WB1 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote atta