libjxl

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. libjxl is named by repository URL in the Tier 1 scope table as 'jpegxl', in the 'Core infrastructure data parsers' row, where a complicated, high-impact improvement tops out at $15,000 against a $100 floor and memory-safety hardening carries a 2× or 3× multiplier. Patches must be one to twelve months old at submission, are capped at three per person per month, and sanctions and territory exclusions apply. CVE history 2 Last 12 months 13 Lifetime Memory safety 65 % Parsing/validation 20 % Denial of service 10 % Info disclosure 3 % Latest advisories Loading the feed Overview libjxl is the reference implementation of JPEG XL. It decodes natively in Safari on macOS and iOS and across the Apple image pipeline, ships in Adobe products, sits behind a flag in Firefox, and is now a standard decoder in ImageMagick, libvips, GIMP and the major Linux image stacks. That is the position libwebp held immediately before CVE-2023-4863 became a cross-industry emergency: a new and extremely complex parser being wired into operating-system image pipelines, where one decoder bug is reachable from any image anyone renders. Google both funds the programme and maintains the project, and [email protected] processes reports with no bounty attached, so sorona.xyz pays you directly on qualified, reproduced findings. In scope [email protected] is the project's security channel and the object it covers is the libjxl tree; Brotli is a separate project and sits outside. Nothing narrower than the codec is carved out, and everything below is inside it The JPEG XL bitstream decoder in both of its modes, modular and VarDCT, together with the entropy-coding layer underneath them The JPEG recompression path, which reconstructs an original JPEG bit-exactly and is the most intricate single piece of logic in the codec Frame-header, table-of-contents and section parsing, and the multi-frame and animation paths those drive Integer arithmetic on image dimensions, group sizes and upsampling factors, where a declared size is turned into an allocation before anything validates it The libjxl and libjxl_threads API boundary in full, since that is how ImageMagick, libvips, GIMP and the OS image pipelines actually reach the decoder The multithreaded decode paths, where work is split across groups and the synchronisation between them is itself attacker-influenced Out of scope One-line patches for non-exploitable crashes and resource-exhaustion denial of service, which the Patch Rewards rules say will not generally be rewarded Brotli itself, which is a separate project on the Google OSS VRP tier list and is not covered by this scope Patches the maintainers decline, because the money attaches to a patch that is merged and stays merged rather than to one that is proposed Patches outside the one-to-twelve-month age window the programme applies at submission time Submissions beyond the cap of three per person per month Most-valued findings Heap corruption in the modular or VarDCT decoder reachable from a crafted JXL file, which is 65% of this project's bug history and the exact shape CVE-2023-4863 took in libwebp one position earlier in the same ecosystem A decoder bug reachable through the OS image pipeline rather than through a standalone tool. An image rendered by Safari or a system thumbnailer is unattended attacker input at enormous scale Memory safety in the JPEG recompression path, the most complex and least-travelled code in the tree Integer overflow on dimensions, group sizes or upsampling factors that produces an undersized buffer the decode then writes past Frame, TOC or animation parsing flaws where the declared structure and the data actually present diverge, the point where a fresh parser's assumptions are thinnest Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report to [email protected] with the JXL file that triggers it; if it cannot be reproduced it is not eligible Brotli is excluded here: it is a separate project on the Google OSS VRP tier list and is not part of this scope If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month. That is a separate pathway with its own rules On that pathway libjxl is Tier 1 as 'jpegxl' in the 'Core infrastructure data parsers' row, patches must be one to twelve months old, submissions are capped at three per person per month, and one-liners for non-exploitable crashes or resource exhaustion are not rewarded Being a core libjxl developer does not disqualify you from the patch money. The programme's own rules state that core developers' patches most certainly do qualify Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the libjxl security team through [email protected] , which is also the project's OSS-Fuzz primary contact. Patch Rewards imposes no confidentiality or embargo term of its own, so timing is the project's call; hold the detail until a release is out, because the fix has to reach Apple's image pipeline, Adobe and the Linux image stacks before it protects anyone. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability