CVE-2023-0645: Out of Bounds read in libjxl

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-11 · updated 2026-06-29
Weakness: CWE-125

Description

An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. We recommend upgrading to version 0.8.1 or past commit https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159 https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159

Affected products

libjxl: before 0.8.1 — fixed in 0.8.1

How to fix

Upgrade to a fixed version: libjxl 0.8.1. Check the vendor advisory for mitigations.

References

https://github.com/libjxl/libjxl/pull/2101
https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159
http://www.openwall.com/lists/oss-security/2026/06/29/3
https://github.com/libjxl/libjxl/pull/2101
https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159

Get alerted when CVE-2023-0645 or the next vulnerability affects your stack