CVE-2026-1837
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A specially crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory, and then data from another uninitialized region is copied to pixel data. This occurs during color transformation of grayscale images to another grayscale color space when using the LCMS2 CMS engine.
Risk Assessment
The risk involves potential leakage of sensitive data from memory or application crashes, which could lead to data security breaches or service disruption.
Recommendation
It is recommended to immediately update libjxl to a patched version or switch the CMS engine to a non-LCMS2 option (if feasible) until a fix is released.
Other vulnerabilities in libjxl
See all- CVE-2026-52584High
Buffer overflow vulnerability in libjxl library version 0.11.2 and earlier in the DecodeImageAPNG function. A local attacker can exploit this to obtain sensitive information.
- CVE-2023-35790High
An issue was discovered in libjxl before version 0.8.2 in dec_patch_dictionary.cc. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop.
- CVE-2023-0645Medium
An out-of-bounds read vulnerability exists in libjxl. An attacker can cause an out-of-bounds read in the EXIF handler by using a specially crafted file.
Original NVD description (English source)
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).