A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.
This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libjxl | Jul 15, 2026 | Feb 11, 2026 |
| Amazon Linux Ami 2 | — | Upgrade firefoxUpgrade thunderbird | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade jxl-pixbuf-loader-debuginfoUpgrade jpegxl-debuginfoUpgrade firefox-debugsourceUpgrade jpegxl-debugsourceUpgrade libjxlUpgrade libjxl-devtoolsUpgrade firefoxUpgrade firefox-debuginfoUpgrade libjxl-utils-debuginfoUpgrade libjxl-utilsUpgrade jxl-pixbuf-loaderUpgrade libjxl-develUpgrade libjxl-debuginfoUpgrade jpegxl-docUpgrade libjxl-devtools-debuginfo | Mar 9, 2026 | Feb 11, 2026 |
| Apple Osx Applejpeg | — | Upgrade macOS to the latest version | May 13, 2026 | May 11, 2026 |
| Debian | — | Upgrade jpeg-xl | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade libjxl0_11Upgrade libjxl-toolsUpgrade libjxl-develUpgrade libjxl0_11-x86-64-v3 | Mar 27, 2026 | Feb 25, 2026 |
| Ubuntu | — | Upgrade libjpegxl-javaUpgrade libjxl-toolsUpgrade libjxl0.11 | Apr 3, 2026 | Feb 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub