Is CVE-2023-0645 actively exploited?

No active exploitation of CVE-2023-0645 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-0645 be exploited remotely?

Yes. CVE-2023-0645 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-0645?

CVE-2023-0645 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2023-0645

CRITICAL

CVE-2023-0645

CWE-125Published: April 11, 2023· Updated: Jun 29, 2026

9.1

CVSS v3.1

Official Description

An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. We recommend upgrading to version 0.8.1 or past commit https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159 https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159

NVD Source

Risk Analysis

The libjxl library contains an out-of-bounds read vulnerability in its EXIF handler. An attacker can trigger this by providing a specially crafted file, potentially leading to information disclosure or system crashes. This is a critical risk for any application processing image files using this library.

The vulnerability is remotely exploitable with low complexity, but there is no known public exploit or CISA KEV entry.

Recommended Action

Upgrade libjxl to version 0.8.1 or apply the fix provided in the referenced GitHub commit.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2023-0645 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), availability disruption (denial of service), with a CVSS base score of 9.1.