The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.
This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libjxl | Jul 15, 2026 | Feb 11, 2026 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade firefox | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade jxl-pixbuf-loaderUpgrade libjxl-develUpgrade libjxl-utilsUpgrade libjxl-utils-debuginfoUpgrade libjxl-debuginfoUpgrade libjxl-devtools-debuginfoUpgrade jpegxl-docUpgrade libjxlUpgrade firefox-debuginfoUpgrade libjxl-devtoolsUpgrade jpegxl-debugsourceUpgrade firefoxUpgrade firefox-debugsourceUpgrade jxl-pixbuf-loader-debuginfoUpgrade jpegxl-debuginfo | Mar 9, 2026 | Feb 11, 2026 |
| Apple Osx Applejpeg | — | Upgrade macOS to the latest version | May 13, 2026 | May 11, 2026 |
| Debian | — | Upgrade jpeg-xl | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade libjxl-toolsUpgrade libjxl0_11Upgrade libjxl0_11-x86-64-v3Upgrade libjxl-devel | Mar 27, 2026 | Feb 25, 2026 |
| Ubuntu | — | Upgrade libjxl0.11Upgrade libjpegxl-javaUpgrade libjxl-tools | Apr 3, 2026 | Feb 11, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub