N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-11403

CVE-2024-11403: There exists an out of bounds read/write in LibJXL versions prior to commit...

There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-11403

CVE-2024-11403:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an out-of-bounds read/write in the JPEG decoder used in LibJXL (specifically when recompressing JPEGs via JxlEncoderAddJPEGFrame) and in the standalone jpegli library. It occurs due to improper bounds checking with incomplete Huffman codes. The provided commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99 patches this by increasing the size of a constant, kJpegHuffmanLutSize, from 758 to 1024 in two header files: lib/jpegli/huffman.h and lib/jxl/jpeg/enc_jpeg_huffman_decode.h.

This constant defines the maximum size for a Huffman lookup table. The commit message and vulnerability description clarify that the previous size was insufficient for JPEGs with 'incomplete' Huffman codes, leading to potential out-of-bounds writes when building these tables.

Based on common JPEG library structures and the file paths involved (e.g., huffman.h, dec_huffman.cc), the functions responsible for constructing these Huffman tables are typically named BuildHuffmanTable. These functions, operating within their respective namespaces (jpegli and jxl::jpeg), would use kJpegHuffmanLutSize to allocate or define the bounds for the Huffman table. When the older, smaller size was used, these functions would attempt to write past the allocated buffer if the input JPEG's Huffman codes required more table space than anticipated, thus causing the out-of-bounds write. The vulnerability description also mentions potential out-of-bounds reads, which could be a consequence of reading from a corrupted table or uninitialized memory due to the write.

The identified functions, jpegli::BuildHuffmanTable and jxl::jpeg::BuildHuffmanTable, are the most direct locations where the out-of-bounds write would occur due to the undersized kJpegHuffmanLutSize when processing malicious or malformed JPEG files with incomplete Huffman codes. These functions would appear in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.