CVE-2026-1837

libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2

8.7 HighFix available

This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.33%Up 0.3 points since Feb 12, 2026

What each source reports

CVE List Score used 8.7

libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2

Record: CVE-2026-1837
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-805, CWE-787
Updated: 2026-11-02

EUVDEUVD-2026-6177 8.7

Record: EUVD-2026-6177
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-76gx-97cq-65f5 8.7

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized...

Record: GHSA-76gx-97cq-65f5
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770, CWE-787, CWE-805
Updated: 2026-11-02

NVD 8.7

Record: CVE-2026-1837
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-805, CWE-770, CWE-787
Updated: 2026-11-02

OSVALPINE-CVE-2026-1837 7.5

Record: ALPINE-CVE-2026-1837
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 8.7

libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2

Record: CVE-2026-1837
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-805
Updated: 2026-11-02

Show 8 moreShow less

OSVDEBIAN-CVE-2026-1837 7.5

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

Record: DEBIAN-CVE-2026-1837
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-1837 8.7

Record: UBUNTU-CVE-2026-1837
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2026-0548 No score

Updated libjxl package fixes security vulnerabilities

Uninitialized memory read in decoder due to incorrect optimization in patch handling. (CVE-2025-12474) Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc. (CVE-2025-70103) Out-of-bounds write in grayscale color transformation when using LCMS2. (CVE-2026-1837) Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function. (CVE-2026-52584)

Record: MGASA-2026-0548
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10271-1 No score

libjxl-devel-0.11.2-1.1 on GA media

These are all security issues fixed in the libjxl-devel-0.11.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10271-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20385-1 No score

Security update for libjxl

This update for libjxl fixes the following issues:

Update to libjxl 0.11.2:

CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory (bsc#1258090).
CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memory (bsc#1258091).

Record: openSUSE-SU-2026:20385-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0648-1 No score

Security update for libjxl

This update for libjxl fixes the following issues:

CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory (bsc#1258090).
CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memory (bsc#1258091).

Record: SUSE-SU-2026:0648-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20903-1 No score

Security update for libjxl

This update for libjxl fixes the following issues:

Update to libjxl 0.11.2:

CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory (bsc#1258090).
CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memory (bsc#1258091).

Record: SUSE-SU-2026:20903-1
Updated: 2026-11-02

OSVUSN-8146-1 No score

jpeg-xl vulnerability

Daniel Novomeský discovered that libjxl did not properly manage memory when decoding certain files. An attacker could use this issue to cause libjxl to crash, resulting in denial of service, or possibly execute arbitrary code.

Record: USN-8146-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libjxl` Alpine:v3.23	0.9.0 up to 0.11.2-r0	0.11.2-r0
`jpeg-xl` Debian:13	before 0.11.2-0.1~deb13u1, plus listed versions 0.11.1-40.11.1-50.11.1-6	0.11.2-0.1~deb13u1
`jpeg-xl` Debian:14	before 0.11.2-0.1, plus listed versions 0.11.1-40.11.1-50.11.1-60.11.2-0.1~deb13u10.11.2-0.1~deb13u2	0.11.2-0.1
`libjxl` Mageia:10 From an advisory covering 4 CVEs	before 0.11.2-1.mga10	0.11.2-1.mga10
`libjxl` SUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 2 CVEs	before 0.10.3-150700.4.6.1	0.10.3-150700.4.6.1
`libjxl` SUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs	before 0.11.2-160000.1.1	0.11.2-160000.1.1
`libjxl` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs	before 0.11.2-160000.1.1	0.11.2-160000.1.1
`jpeg-xl` Ubuntu:25.10	before 0.11.1-6ubuntu1.1, plus listed versions 0.11.1-40.11.1-6ubuntu1	0.11.1-6ubuntu1.1
`libjxl` openSUSE:Tumbleweed	before 0.11.2-1.1	0.11.2-1.1
`libjxl` openSUSE:Leap 16.0 From an advisory covering 2 CVEs	before 0.11.2-160000.1.1	0.11.2-160000.1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-1837 is a high vulnerability (CVSS 8.7) in Google Libjxl, published February 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. Fixed in libjxl 0.11.2-r0.

References

Show 24 moreShow less