OSV-2022-608: Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow
A heap-use-after-free vulnerability exists in the libjxl library within the function jxl::WriteToPixelCallbackStage::ProcessRow. This issue was reported by OSS-Fuzz and involves a read operation on freed heap memory, which can lead to undefined behavior or crashes when processing image data.
AI Analysis
Technical Summary
The vulnerability identified as OSV-2022-608 is a heap-use-after-free read occurring in the libjxl library's jxl::WriteToPixelCallbackStage::ProcessRow function. The crash was detected by OSS-Fuzz and involves accessing memory that has already been freed during image processing operations in the LowMemoryRenderPipeline. Multiple versions of libjxl up to and including 0.12.0 and various snapshots are affected. No CVSS score or detailed impact metrics are provided, and no vendor patch or advisory is referenced in the data.
Potential Impact
The heap-use-after-free vulnerability can cause application crashes or potentially undefined behavior when processing images with affected versions of libjxl. There is no information about known exploits in the wild or direct impact such as code execution or data corruption. The impact is primarily stability and reliability of applications using the vulnerable library versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the libjxl project and OSS-Fuzz reports for updates and apply patches once available.
OSV-2022-608: Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow
Description
A heap-use-after-free vulnerability exists in the libjxl library within the function jxl::WriteToPixelCallbackStage::ProcessRow. This issue was reported by OSS-Fuzz and involves a read operation on freed heap memory, which can lead to undefined behavior or crashes when processing image data.
Affected software
pkg:generic/libjxlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as OSV-2022-608 is a heap-use-after-free read occurring in the libjxl library's jxl::WriteToPixelCallbackStage::ProcessRow function. The crash was detected by OSS-Fuzz and involves accessing memory that has already been freed during image processing operations in the LowMemoryRenderPipeline. Multiple versions of libjxl up to and including 0.12.0 and various snapshots are affected. No CVSS score or detailed impact metrics are provided, and no vendor patch or advisory is referenced in the data.
Potential Impact
The heap-use-after-free vulnerability can cause application crashes or potentially undefined behavior when processing images with affected versions of libjxl. There is no information about known exploits in the wild or direct impact such as code execution or data corruption. The impact is primarily stability and reliability of applications using the vulnerable library versions.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor the libjxl project and OSS-Fuzz reports for updates and apply patches once available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- OSV-2022-608
- Osv Schema Version
- 1.2.0
- Ecosystems
- ["OSS-Fuzz"]
Threat ID: 6a46ecdf27e9c79719440c2f
Added to database: 07/02/2026, 22:57:35 UTC
Last enriched: 07/02/2026, 23:25:06 UTC
Last updated: 09/05/2026, 05:56:22 UTC
Views: 28
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.