Is CVE-2024-11403 actively exploited?

No active exploitation of CVE-2024-11403 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-11403 be exploited remotely?

Yes. CVE-2024-11403 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-11403?

CVE-2024-11403 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2024-11403

CRITICAL

CVE-2024-11403

CWE-125Published: November 25, 2024· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.

NVD Source

Risk Analysis

LibJXL contains an out-of-bounds read/write vulnerability in its JPEG encoder when processing untrusted input. This critical flaw allows for potential memory corruption or unauthorized data access, and its CVSS score of 9.8 reflects the high severity of such an issue.

There is no known public exploit for this vulnerability, and it is not currently listed in CISA KEV. It is remotely exploitable due to the network-accessible nature of the affected component.

Recommended Action

Users should update LibJXL to the latest version, specifically ensuring the fix for the identified commit is applied.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2024-11403 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.