Description
Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jpeg-xl | 0.11.2-5.1 | — |
| Debian 13 | jpeg-xl | 0.11.2-0.1~deb13u2 | — |
| Debian 12 | jpeg-xl | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | jpeg-xl | 0.11.1-6ubuntu4.2 | USN-8397-1 |
| Ubuntu 25.10 | jpeg-xl | 0.11.1-6ubuntu1.2 | USN-8397-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libjxl | 0.11.2-160000.2.1 | SUSE-SU-2026:22174-1 |
| SLES for SAP 16.0 | mozjs128 | 128.14.0-160000.3.1 | SUSE-SU-2026:22210-1, SUSE-SU-2026:22201-1 |
| SLES 16.0 | libjxl | 0.11.2-160000.2.1 | SUSE-SU-2026:22174-1 |
| SLES 16.0 | mozjs128 | 128.14.0-160000.3.1 | SUSE-SU-2026:22210-1, SUSE-SU-2026:22201-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libjxl | 0.11.2-2.1 | openSUSE-SU-2026:10910-1 |
| openSUSE Tumbleweed | mozjs115 | 115.15.0-9.1 | openSUSE-SU-2026:10935-1 |
| openSUSE Tumbleweed | mozjs140 | 140.10.1-2.1 | openSUSE-SU-2026:10955-1 |
| openSUSE Leap 16.0 | libjxl +1 | 0.11.2-160000.2.1 | openSUSE-SU-2026:21100-1 |
| openSUSE Leap 16.0 | mozjs128 | 128.14.0-160000.3.1 | openSUSE-SU-2026:21114-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libjxl +5 | 1:0.10.3-56.amzn2023 | ALAS2023-2026-1828 |
Advisories 10
- openSUSE-SU-2026:21114-1 Security update for mozjs128 SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:21100-1 Security update for libjxl SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:22174-1 Security update for libjxl SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22210-1 Security update for mozjs128 SUSE / openSUSE Security Updates · Jun 24, 2026
- SUSE-SU-2026:22201-1 Security update for mozjs128 SUSE / openSUSE Security Updates · Jun 24, 2026
- ALAS2023-2026-1828 Important: jpegxl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- USN-8397-1 jpeg-xl vulnerability Ubuntu Security Notices (USN) · Jun 8, 2026
- openSUSE-SU-2026:10955-1 libmozjs-140-0-140.10.1-2.1 on GA media SUSE / openSUSE Security Updates · Jun 5, 2026
- openSUSE-SU-2026:10935-1 libmozjs-115-0-115.15.0-9.1 on GA media SUSE / openSUSE Security Updates · Jun 3, 2026
- openSUSE-SU-2026:10910-1 libjxl-devel-0.11.2-2.1 on GA media SUSE / openSUSE Security Updates · May 31, 2026