What is GHSA-V8GQ-5GRQ-9728?

GHSA-V8GQ-5GRQ-9728 is a high-severity security vulnerability in mozjpeg (rust), affecting versions < 0.8.19. It is fixed in 0.8.19.

Which versions of mozjpeg are affected by GHSA-V8GQ-5GRQ-9728?

mozjpeg (rust) versions < 0.8.19 is affected.

Is there a fix for GHSA-V8GQ-5GRQ-9728?

Yes. GHSA-V8GQ-5GRQ-9728 is fixed in 0.8.19. Upgrade to this version or later.

Is GHSA-V8GQ-5GRQ-9728 exploitable, and should I be worried?

Whether GHSA-V8GQ-5GRQ-9728 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-V8GQ-5GRQ-9728 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

GHSA-V8GQ-5GRQ-9728 in mozjpeg

Q: Which versions of mozjpeg are affected by GHSA-V8GQ-5GRQ-9728?

mozjpeg (rust) versions < 0.8.19 is affected.

Q: Is there a fix for GHSA-V8GQ-5GRQ-9728?

Yes. GHSA-V8GQ-5GRQ-9728 is fixed in 0.8.19. Upgrade to this version or later.

Q: Is GHSA-V8GQ-5GRQ-9728 exploitable, and should I be worried?

Whether GHSA-V8GQ-5GRQ-9728 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-V8GQ-5GRQ-9728 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-V8GQ-5GRQ-9728?

Upgrade mozjpeg to 0.8.19 or later.

Summary

mozjpeg DecompressScanlines::read_scanlines is Unsound

This issue and vector is similar to RUSTSEC-2020-0029 of rgb crate which mozjpeg depends on.

Affected versions of mozjpeg crate allow creating instances of any type T from bytes,
and do not correctly constrain T to the types for which it is safe to do so.

Examples of safety violation possible for a type T:

T contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.
T requires a safety and/or validity invariant for its construction that may be violated.

The issue was fixed in 0.8.19 by using safer types and involving rgb dependency bump.

Impact

Affected versions

mozjpeg (< 0.8.19)

Security releases

mozjpeg → 0.8.19 (rust)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade mozjpeg to 0.8.19 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is GHSA-V8GQ-5GRQ-9728? GHSA-V8GQ-5GRQ-9728 is a high-severity security vulnerability in mozjpeg (rust), affecting versions < 0.8.19. It is fixed in 0.8.19.
Which versions of mozjpeg are affected by GHSA-V8GQ-5GRQ-9728? mozjpeg (rust) versions < 0.8.19 is affected.
Is there a fix for GHSA-V8GQ-5GRQ-9728? Yes. GHSA-V8GQ-5GRQ-9728 is fixed in 0.8.19. Upgrade to this version or later.
Is GHSA-V8GQ-5GRQ-9728 exploitable, and should I be worried? Whether GHSA-V8GQ-5GRQ-9728 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-V8GQ-5GRQ-9728 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-V8GQ-5GRQ-9728? Upgrade mozjpeg to 0.8.19 or later.