What is CVE-2024-11498?

CVE-2024-11498 is a high-severity vulnerability in Libjxl, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2024-11-25.

How severe is CVE-2024-11498?

High severity. CVSS v3 base score is 7.5 out of 10.

Resource exhaustion in Libjxl

CVE-2024-11498

There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a…

Vulnerability class: DoS (Denial of Service)

EPSS: 0.006 (44.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Libjxl — versions 0.11.0, 0.10.0-2, 0.9.0-3
Libjxl_project Libjxl

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

cve-coordination@google.com (Patch, Issue Tracking)

Frequently asked questions

What is CVE-2024-11498?: CVE-2024-11498 is a high-severity vulnerability in Libjxl, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2024-11-25.
How severe is CVE-2024-11498?: High severity. CVSS v3 base score is 7.5 out of 10.