CVE-2026-52584
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Buffer overflow vulnerability in libjxl library version 0.11.2 and earlier in the DecodeImageAPNG function. A local attacker can exploit this to obtain sensitive information.
Risk Assessment
An attacker can read process memory, potentially leaking confidential information such as keys or user data.
Recommendation
Update libjxl to a version later than 0.11.2. Restrict local access to systems using this library.
Other vulnerabilities in libjxl
See all- CVE-2026-1837High
A specially crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory, and then data from another uninitialized region is copied to pixel data. This occurs during color transformation of grayscale images to another grayscale color space when using the LCMS2 CMS engine.
- CVE-2023-35790High
An issue was discovered in libjxl before version 0.8.2 in dec_patch_dictionary.cc. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop.
- CVE-2023-0645Medium
An out-of-bounds read vulnerability exists in libjxl. An attacker can cause an out-of-bounds read in the EXIF handler by using a specially crafted file.
Original NVD description (English source)
Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function