jxrlib: memory bugs on damaged JPEG XR files, fixed in mircomir/jxrlib 1.4.4, still in most distributions
// AI summary
Memory bugs in jxrlib, including heap overflow from damaged JPEG XR files, are fixed in version 1.4.4 but remain in many distributions.
// from the source
Posted by Joachim Rütter on Oct 24 Hello, jxrlib, Microsoft s JPEG XR library (abandoned upstream), has memory bugs that a damaged JPEG XR file of a few hundred bytes triggers, including a heap buffer overflow write. All of them are fixed in public in the maintained fork github.com/mircomir/jxrlib (1.4.4, released 2026-10-09), but most distributions still ship older code. I found them while fuzzing the decoders in my image viewer, Featherview. Bugs (line numbers from...