Every CVE Search/ Get API key

CVE-2026-52584

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain...

7.1 HighFix available

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

0.12%Unchanged since Jul 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Record
CVE-2026-52584
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-121
Updated
2026-11-02
EUVDEUVD-2026-45352 7.1

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Record
EUVD-2026-45352
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9p88-gfff-g86f 7.1

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain...

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Record
GHSA-9p88-gfff-g86f
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-121
Updated
2026-11-02
NVD 7.1

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Record
CVE-2026-52584
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-121
Updated
2026-11-02
OSV 7.1

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Record
CVE-2026-52584
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-52584 7.1

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Record
DEBIAN-CVE-2026-52584
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2026-3546 7.1

jpegxl security update

This package contains a reference implementation of JPEG XL (encoder and decoder).

Security Fix(es):

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function(CVE-2026-52584)

Record
OESA-2026-3546
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-52584 7.1

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Record
UBUNTU-CVE-2026-52584
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVMGASA-2026-0548 No score

Updated libjxl package fixes security vulnerabilities

Uninitialized memory read in decoder due to incorrect optimization in patch handling. (CVE-2025-12474) Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc. (CVE-2025-70103) Out-of-bounds write in grayscale color transformation when using LCMS2. (CVE-2026-1837) Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function. (CVE-2026-52584)

Record
MGASA-2026-0548
Updated
2026-11-02
OSVopenSUSE-SU-2026:11537-1 No score

libjxl-devel-0.12.0-1.1 on GA media

These are all security issues fixed in the libjxl-devel-0.12.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11537-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-52584 No score

CVE-2026-52584 in jpeg-xl - Patched by Root

Root has patched CVE-2026-52584 in the jpeg-xl package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-52584
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
jpeg-xl
Debian:12
 All versions, plus listed versions
0.10.3-10.10.3-20.10.3-30.10.3-40.10.3-5
Show 45 moreShow less
0.10.4-10.10.4-20.11.1-10.11.1-20.11.1-30.11.1-40.11.1-50.11.1-60.11.2-0.10.11.2-0.1~deb13u10.11.2-0.1~deb13u20.11.2-0.1~deb13u30.11.2-10.11.2-20.11.2-30.11.2-3~exp10.11.2-40.11.2-50.11.2-5.10.7.0-100.7.0-10+deb12u10.7.0-10.10.7.0-10.20.8.0-10.8.0~git20221120.4167056-10.8.0~git20221123.8bf8deb-10.8.0~git20230102.26a5158-10.8.0~git20230118.bcacd51-10.8.0~git20230125.a67e970-10.8.1-10.8.1-20.8.2-10.8.2-20.8.2-30.8.2-40.9.0~git20230612.38b629f-10.9.0~git20230612.38b629f-20.9.0~git20230612.38b629f-30.9.0~git20230612.38b629f-40.9.0~git20230623.689da0f-10.9.0~git20230623.689da0f-20.9.0~git20230623.689da0f-30.9.0~git20230623.689da0f-40.9.2-10.9.2-10
 None known
jpeg-xl
Debian:13
 before 0.11.2-0.1~deb13u3, plus listed versions
0.11.1-40.11.1-50.11.1-60.11.2-0.1~deb13u10.11.2-0.1~deb13u2
0.11.2-0.1~deb13u3
jpeg-xl
Debian:14
 before 0.11.2-5.1, plus listed versions
0.11.1-40.11.1-50.11.1-60.11.2-0.10.11.2-0.1~deb13u1
Show 8 moreShow less
0.11.2-0.1~deb13u20.11.2-0.1~deb13u30.11.2-10.11.2-20.11.2-30.11.2-3~exp10.11.2-40.11.2-5
0.11.2-5.1
libjxl
Mageia:10
From an advisory covering 4 CVEs
 before 0.11.2-1.mga10
0.11.2-1.mga10
jpegxl
openEuler:24.03-LTS-SP4
 before 0.11.2-4.oe2403sp4
0.11.2-4.oe2403sp4
jpeg-xl
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.7.0-10ubuntu20.7.0-10.2ubuntu10.7.0-10.2ubuntu40.7.0-10.2ubuntu50.7.0-10.2ubuntu60.7.0-10.2ubuntu6.1
 None known
jpeg-xl
Ubuntu:26.10
 All versions, plus listed versions
0.11.1-6ubuntu40.11.1-6ubuntu50.11.2-5ubuntu10.11.2-5.1ubuntu1
 None known
jpeg-xl
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.11.1-40.11.1-6ubuntu10.11.1-6ubuntu30.11.1-6ubuntu40.11.1-6ubuntu4.2
 None known
libjxl
openSUSE:Tumbleweed
 before 0.12.0-1.1
0.12.0-1.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-52584 is a high vulnerability (CVSS 7.1) in libjxl, published July 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in jpeg-xl 0.11.2-0.1~deb13u3.

References

Show 17 moreShow less
This page doesn't list everything

Left out here: 8 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open