External risk intelligence

libjxl Out of Bounds Read in Exif Handler

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2023-0645

The vulnerability exists in libjxl, a library used for processing image files. While libraries are often integrated into applications that process user-uploaded content or fetch remote images—potentially exposing the library to internet-sourced data—the library itself is not a standalone service or public-facing endpoint, making its reachability dependent on the specific implementation.

Out-of-bounds Read

Libjxl Project Libjxl

before 0.8.1

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the libjxl image processing library could allow an attacker to read out-of-bounds memory when processing a specially crafted file. This could potentially lead to system instability or compromise, depending on how the library is integrated into applications. The main concern is confirming relevance and exposure.

A file processing flaw can expose system memory.
Leaders should remember this for software supply chain awareness.
Confirm if this library is used and exposed to untrusted files.

Attack Path

How an attacker could exploit the issue

An attacker could target this vulnerability by providing a specially crafted image file to an application that uses the libjxl library's EXIF handler. The library's insufficient bounds checking when processing image metadata could lead to an out-of-bounds read, potentially allowing an attacker to access sensitive information or cause a denial of service.

Requires a crafted image file.
Triggered by EXIF data handling.
Results in information disclosure or crash.

Live Threat

Current exploitation, exposure, and threat context

An out-of-bounds read can occur in the exif handler when processing a specifically crafted file. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution when the libjxl library processes the malicious file.

System data integrity.
Processing malicious image files.
Denial of service or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Ownership of this critical vulnerability in the libjxl library likely falls to application teams integrating the library and potentially platform teams managing shared components. The immediate first step is to identify all systems utilizing affected versions of libjxl, assess their exposure to specifically crafted image files, and confirm their business criticality to prioritize remediation efforts.

Application or platform teams own remediation.
Verify affected systems and exposure.
Plan updates or apply mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is libjxl?

libjxl is an open-source software library used by developers to encode and decode JPEG XL image files. Because it provides core functionality for handling image data—including metadata like EXIF—it is frequently integrated into larger applications, web browsers, or image processing tools that need to support modern, high-quality image formats.

What does CVE-2023-0645 mean?

This vulnerability is an out-of-bounds read, classified as CWE-125. In plain English, the software fails to properly verify the size of data within an image's EXIF metadata before reading it. This flaw allows the program to read memory areas it shouldn't access, which can result in the application crashing or potentially leaking sensitive system information.

How is this vulnerability triggered?

The issue is triggered only when the library processes a specifically malformed or malicious image file designed to exploit the EXIF handler. Simply having the library installed on a system does not trigger the bug; the vulnerability remains dormant unless an application actively uses the library to open and parse a crafted image file.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal notes that libjxl is a library, not a standalone service, so risk depends on how your specific applications use it. If an application utilizes libjxl to process user-uploaded content or fetch images from the internet, it could be exposed to malicious files. You should check if your internet-facing applications rely on this library to handle image uploads.

What should I do if I use libjxl?

Your first step is to perform an inventory to identify which applications in your environment rely on libjxl and confirm if they are using a version older than 0.8.1. Once identified, coordinate with the teams managing those specific applications to update the library to a patched version, as this is the standard way to resolve the flaw in the underlying code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.