CVE-2021-22563

Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering splines. The OOB read access can either lead to a segfault, or rendering splines based on other process memory. It is recommended to upgrade past 0.6.0 or patch with https://github.com/libjxl/libjxl/pull/757

• CWE-126
• CWE-125

• https://github.com/libjxl/libjxl/issues/735Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/libjxl/libjxl/pull/757Patch, Third Party Advisory
• https://github.com/libjxl/libjxl/issues/735Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/libjxl/libjxl/pull/757Patch, Third Party Advisory

Published

Nov 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22552An untrusted memory read vulnerability in Asylo versions up …5.5
• CVE-2021-22553Any git operation is passed through Jetty and a session is c…7.5
• CVE-2021-22555A heap out-of-bounds write affecting Linux since v2.6.19-rc1…7.8
• CVE-2021-22556The Security Team discovered an integer overflow bug that al…7.8
• CVE-2021-22557SLO generator allows for loading of YAML files that if craft…7.8
• CVE-2021-2256Vulnerability in the Oracle Storage Cloud Software Appliance…10
• CVE-2021-22564For certain valid JPEG XL images with a size slightly larger…5.5
• CVE-2021-22565An attacker could prematurely expire a verification code, ma…6.5
• CVE-2021-22566An incorrect setting of UXN bits within mmu_flags_to_s1_pte_…9.8
• CVE-2021-22567Bidirectional Unicode text can be interpreted and compiled d…3.5
• CVE-2021-22568When using the dart pub publish command to publish a package…8.8
• CVE-2021-22569An issue in protobuf-java allowed the interleaving of com.go…5.5