{"id":"OSV-2022-608","aliases":[],"status":"published","title":"Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277\n\n```\nCrash type: Heap-use-after-free READ 4\nCrash state:\njxl::WriteToPixelCallbackStage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2022-07-21T00:01:50.967627Z","modified":"2026-11-11T14:30:03Z","affected":[{"source":"osv","ecosystem":"OSS-Fuzz","package":"libjxl","ranges":[{"type":"GIT","events":[{"introduced":"eafb38fb4f3d2e00f9402a0c09ac592ebfd6a795"}]}],"versions":["v0.7-base","v0.7rc","v0.7.0","v1.0-snapshot","v0.8-snapshot","v0.8.0rc1","v0.8.0","v0.8.1","v0.9-snapshot","v0.8.2","v0.9.0","v0.9.1","v0.9.2","v0.10.0","v0.10-snapshot","v0.10.1","v0.10.2","v0.10.3","v0.8.3","v0.9.3","v0.7.1","v0.11-snapshot","v0.11.0","v0.10.4","v0.11.1","v0.8.4","v0.9.4","v0.7.2","v0.7.3","v0.10.5","v0.11.2","v0.8.5","v0.9.5","v0.12-snapshot","v0.12.0","v0.13.0"]}],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277","tags":["report"]}],"sources":{"osv":[{"id":"OSV-2022-608","title":"Heap-use-after-free in jxl::WriteToPixelCallbackStage::ProcessRow","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49277\n\n```\nCrash type: Heap-use-after-free READ 4\nCrash state:\njxl::WriteToPixelCallbackStage::ProcessRow\njxl::LowMemoryRenderPipeline::RenderRect\njxl::LowMemoryRenderPipeline::ProcessBuffers\n```\n","status":"published","published":"2022-07-21T00:01:50.967627Z","modified":"2026-11-11T14:30:03.783789743Z","updated_at":"2026-11-11T14:42:41.779379Z"}]}}