Description
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.
This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libjxl | 0.9 – ≤ 0.11.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jpeg-xl | 0.11.2-0.1 | — |
| Debian 13 | jpeg-xl | 0.11.2-0.1~deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | jpeg-xl | 0.11.1-6ubuntu1.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libjxl | 0.10.3-150700.4.6.1 | SUSE-SU-2026:0648-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libjxl | 0.11.2-160000.1.1 | SUSE-SU-2026:20903-1 |
| SLES 16.0 | libjxl | 0.11.2-160000.1.1 | SUSE-SU-2026:20903-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libjxl | 0.11.2-1.1 | openSUSE-SU-2026:10271-1 |
| openSUSE Leap 16.0 | libjxl | 0.11.2-160000.1.1 | openSUSE-SU-2026:20385-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.23 | libjxl | 0.11.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | firefox | 140.7.1-1.amzn2023.0.1 | ALAS2023-2026-1469 |
| Amazon Linux 2023 | libjxl +5 | 1:0.10.3-55.amzn2023 | ALAS2023-2026-1459 |
| Amazon Linux 2 | thunderbird | 140.7.2-1.amzn2.0.1 | ALAS2-2026-3190 |
Advisories 11
- WID-SEC-2026-1459 Apple iOS und iPadOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- WID-SEC-2026-1463 Apple macOS Sonoma, macOS Sequoia und macOS Tahoe: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 12, 2026
- NCSC-2026-0139 Kwetsbaarheden verholpen in Apple MacOS NCSC-NL (Netherlands) · May 12, 2026
- NCSC-2026-0138 Kwetsbaarheden verholpen in Apple iOS en iPadOS NCSC-NL (Netherlands) · May 12, 2026
- SUSE-SU-2026:20903-1 Security update for libjxl SUSE / openSUSE Security Updates · Apr 2, 2026
- openSUSE-SU-2026:20385-1 Security update for libjxl SUSE / openSUSE Security Updates · Mar 26, 2026
- openSUSE-SU-2026:10271-1 libjxl-devel-0.11.2-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- ALAS2-2026-3190 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 5, 2026
- ALAS2023-2026-1459 Important: jpegxl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2026
- ALAS2023-2026-1469 Important: firefox security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 5, 2026
- SUSE-SU-2026:0648-1 Security update for libjxl SUSE / openSUSE Security Updates · Feb 26, 2026