Log in Start free

Vulnerability · Published Feb 11, 2026 · Assigned by Google

CVE-2026-1837libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2

High 8.8

In plain English

A high-severity out-of-bounds write in libjxl from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 75.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23libjxl0.11.2-r0ALPINE-CVE-2026-1837
Debian:13jpeg-xl0.11.2-0.1~deb13u1DEBIAN-CVE-2026-1837
Debian:14jpeg-xl0.11.2-0.1DEBIAN-CVE-2026-1837
Ubuntu:25.10jpeg-xl0.11.1-6ubuntu1.1UBUNTU-CVE-2026-1837

Affected products (as reported)

VendorProductVersions
Google libjxl 0.9 – through 0.11.1

Weakness: CWE-805, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References