{"id":"CVE-2025-70103","aliases":["DEBIAN-CVE-2025-70103","EUVD-2025-209978","GHSA-4xm2-q73p-253r","MGASA-2026-0516","MGASA-2026-0548","OESA-2026-3067","SUSE-SU-2026:22174-1","SUSE-SU-2026:22201-1","SUSE-SU-2026:22210-1","SUSE-SU-2026:2286-1","UBUNTU-CVE-2025-70103","USN-8397-1","openSUSE-SU-2026:10910-1","openSUSE-SU-2026:10935-1","openSUSE-SU-2026:10955-1","openSUSE-SU-2026:21100-1","openSUSE-SU-2026:21114-1"],"status":"published","title":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras:...","description":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00432,"percentile":0.37833,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-05-27T00:00:00Z","modified":"2026-10-26T15:30:03Z","fixes":[{"ecosystem":"Debian:13","package":"jpeg-xl","fixed_in":["0.11.2-0.1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jpeg-xl","fixed_in":["0.11.2-5.1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"mozjs140","fixed_in":["140.17.0-1.mga10"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"jpegxl","fixed_in":["0.11.2-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libjxl","fixed_in":["0.11.2-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libjxl","fixed_in":["0.11.2-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"mozjs128","fixed_in":["128.14.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"mozjs128","fixed_in":["128.14.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"jpeg-xl","fixed_in":["0.11.1-6ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"jpeg-xl","fixed_in":["0.11.1-6ubuntu4.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mozjs115","fixed_in":["115.15.0-9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mozjs140","fixed_in":["140.10.1-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libjxl","fixed_in":["0.11.2-160000.2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libjxl-gtk","fixed_in":["0.11.2-160000.2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"mozjs128","fixed_in":["128.14.0-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.3-1","0.10.3-2","0.10.3-3","0.10.3-4","0.10.3-5","0.10.4-1","0.10.4-2","0.11.1-1","0.11.1-2","0.11.1-3","0.11.1-4","0.11.1-5","0.11.1-6","0.11.2-0.1","0.11.2-0.1~deb13u1","0.11.2-0.1~deb13u2","0.11.2-1","0.11.2-2","0.11.2-3","0.11.2-3~exp1","0.11.2-4","0.11.2-5","0.11.2-5.1","0.7.0-10","0.7.0-10+deb12u1","0.7.0-10.1","0.7.0-10.2","0.8.0-1","0.8.0~git20221120.4167056-1","0.8.0~git20221123.8bf8deb-1","0.8.0~git20230102.26a5158-1","0.8.0~git20230118.bcacd51-1","0.8.0~git20230125.a67e970-1","0.8.1-1","0.8.1-2","0.8.2-1","0.8.2-2","0.8.2-3","0.8.2-4","0.9.0~git20230612.38b629f-1","0.9.0~git20230612.38b629f-2","0.9.0~git20230612.38b629f-3","0.9.0~git20230612.38b629f-4","0.9.0~git20230623.689da0f-1","0.9.0~git20230623.689da0f-2","0.9.0~git20230623.689da0f-3","0.9.0~git20230623.689da0f-4","0.9.2-1","0.9.2-10","0.9.2-2","0.9.2-3","0.9.2-4","0.9.2-5","0.9.2-6","0.9.2-7","0.9.2-8","0.9.2-9"]},{"source":"osv","ecosystem":"Debian:13","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-0.1~deb13u2"}]}],"versions":["0.11.1-4","0.11.1-5","0.11.1-6","0.11.2-0.1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-5.1"}]}],"versions":["0.11.1-4","0.11.1-5","0.11.1-6","0.11.2-0.1","0.11.2-0.1~deb13u1","0.11.2-0.1~deb13u2","0.11.2-1","0.11.2-2","0.11.2-3","0.11.2-3~exp1","0.11.2-4","0.11.2-5"]},{"source":"osv","ecosystem":"Mageia:10","package":"mozjs140","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.17.0-1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"jpegxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.14.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.14.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.14.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.14.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-6ubuntu1.2"}]}],"versions":["0.11.1-4","0.11.1-6ubuntu1","0.11.1-6ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-6ubuntu4.2"}]}],"versions":["0.11.1-4","0.11.1-6ubuntu1","0.11.1-6ubuntu3","0.11.1-6ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-6ubuntu1.2"}]}],"versions":["0.11.1-4","0.11.1-6ubuntu1","0.11.1-6ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-6ubuntu4.2"}]}],"versions":["0.11.1-4","0.11.1-6ubuntu1","0.11.1-6ubuntu3","0.11.1-6ubuntu4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.15.0-9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs140","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.10.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-160000.2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libjxl-gtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-160000.2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.14.0-160000.3.1"}]}]}],"references":[{"url":"https://github.com/libjxl/libjxl/issues/4337","tags":["exploit","report"]},{"url":"https://github.com/libjxl/libjxl/pull/4338","tags":["report"]},{"url":"https://github.com/sigdevel/pocs/blob/main/res/libjxl/2025/2","tags":["report"]},{"url":"https://infosec.exchange/@sigdevel/116642233929409910","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/30/7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-70103","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4xm2-q73p-253r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-70103","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0516.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35656","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/TDJLG2FVXLDZ2YCBFB5L3YEGWD2YVZ47/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2026-0548.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35608","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27TWL6UI5V63S5VG5DHCLZLSTE34XF3B/","tags":["web"]},{"url":"https://github.com/libjxl/libjxl/issues/4549","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/30/7","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/W3QKIP6MG3FEJI72LMV2M5365WSHW4BC/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBNA2RFQ3GKA2CBAINVJWJMVWBQLVXDU/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8397-1","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00253.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MFBGIBYAH7ZJ5A2WUH5SPGV5U7TZRYYU/","tags":["web"]},{"url":"https://github.com/libjxl/libjxl/issues/4803","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00478.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3067","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622174-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266460","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-70103","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622201-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266463","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622210-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262286-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-70103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-70103","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12474","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-70103","description":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.","status":"published","published":"2026-05-27T00:00:00Z","modified":"2026-05-30T19:30:38.829Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2025-209978","description":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.","status":"published","published":"2026-05-27T00:00:00Z","modified":"2026-05-30T19:30:38Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:20:59.105484Z"}],"ghsa":[{"id":"GHSA-4xm2-q73p-253r","title":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras:...","description":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.","status":"published","published":"2026-05-27T15:33:25Z","modified":"2026-05-30T21:30:22Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:08:25.52807Z"}],"nvd":[{"id":"CVE-2025-70103","description":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.","status":"published","published":"2026-05-27T15:16:24.783Z","modified":"2026-10-12T22:10:00.247Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:02.090779Z"}],"osv":[{"id":"DEBIAN-CVE-2025-70103","description":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.","status":"published","published":"2026-05-27T15:16:24.783Z","modified":"2026-10-13T09:47:36.089277156Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"OESA-2026-3067","title":"jpegxl security update","description":"This package contains a reference implementation of JPEG XL (encoder and decoder).\r\n\r\nSecurity Fix(es):\n\nHeap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.(CVE-2025-70103)","status":"published","published":"2026-07-19T11:11:57Z","modified":"2026-08-18T01:21:20.041068292Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2025-70103","description":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.","status":"published","published":"2026-05-27T15:16:00Z","modified":"2026-09-25T00:40:11.070100996Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"MGASA-2026-0516","title":"Updated mozjs140 package fixes a security vulnerability","description":"Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM\nimages to the jxl::extras::DecodeImagePNM function in file\nlib/extras/dec/pnm.cc. (CVE-2025-70103)\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:30:03.332280313Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"MGASA-2026-0548","title":"Updated libjxl package fixes security vulnerabilities","description":"Uninitialized memory read in decoder due to incorrect optimization in\npatch handling. (CVE-2025-12474)\nHeap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM\nimages to the jxl::extras::DecodeImagePNM function in file\nlib/extras/dec/pnm.cc. (CVE-2025-70103)\nOut-of-bounds write in grayscale color transformation when using LCMS2.\n(CVE-2026-1837)\nBuffer Overflow vulnerability in libjxl v.0.11.2 and before allows a\nlocal attacker to obtain sensitive information via the DecodeImageAPNG\nfunction. (CVE-2026-52584)\n","status":"published","published":"2026-10-26T15:28:20Z","modified":"2026-10-26T15:30:03.184451351Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10910-1","title":"libjxl-devel-0.11.2-2.1 on GA media","description":"These are all security issues fixed in the libjxl-devel-0.11.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-30T00:00:00Z","modified":"2026-05-31T14:15:05.046621389Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10935-1","title":"libmozjs-115-0-115.15.0-9.1 on GA media","description":"These are all security issues fixed in the libmozjs-115-0-115.15.0-9.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-02T00:00:00Z","modified":"2026-06-03T08:30:21.404924704Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10955-1","title":"libmozjs-140-0-140.10.1-2.1 on GA media","description":"These are all security issues fixed in the libmozjs-140-0-140.10.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-04T00:00:00Z","modified":"2026-06-05T10:45:57.915302097Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21100-1","title":"Security update for libjxl","description":"This update for libjxl fixes the following issue\n\n- CVE-2025-70103: heap buffer overflow when hen processing crafted pbm-images due to insufficient bounds checks\n  (bsc#1266460).\n","status":"published","published":"2026-06-19T10:26:38Z","modified":"2026-06-30T18:24:40.835222801Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21114-1","title":"Security update for mozjs128","description":"This update for mozjs128 fixes the following issue\n\n- CVE-2025-70103: libjxl: heap buffer overflow when hen processing crafted pbm-images due to insufficient bounds checks\n  (bsc#1266463).\n","status":"published","published":"2026-06-20T07:07:40Z","modified":"2026-06-30T18:24:42.650889283Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22174-1","title":"Security update for libjxl","description":"This update for libjxl fixes the following issue\n\n- CVE-2025-70103: heap buffer overflow when hen processing crafted pbm-images due to insufficient bounds checks\n  (bsc#1266460).\n","status":"published","published":"2026-06-19T10:44:10Z","modified":"2026-06-24T18:24:18.187265706Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22201-1","title":"Security update for mozjs128","description":"This update for mozjs128 fixes the following issue\n\n- CVE-2025-70103: libjxl: heap buffer overflow when hen processing crafted pbm-images due to insufficient bounds checks\n  (bsc#1266463).\n","status":"published","published":"2026-06-20T07:03:11Z","modified":"2026-06-24T09:00:08.055612361Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22210-1","title":"Security update for mozjs128","description":"This update for mozjs128 fixes the following issue\n\n- CVE-2025-70103: libjxl: heap buffer overflow when hen processing crafted pbm-images due to insufficient bounds checks\n  (bsc#1266463).\n","status":"published","published":"2026-06-20T07:03:11Z","modified":"2026-06-24T09:00:09.50635883Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2286-1","title":"Security update for libjxl","description":"This update for libjxl fixes the following issues:\n\nSecurity fixes:\n  \n- CVE-2025-70103: heap buffer overflow when hen processing crafted pbm-images due to insufficient bounds checks\n  (bsc#1266460).\n\nOther fixes:\n\n- Update to version 0.10.5:\n  - fix tile dimension in low memory rendering pipeline.\n  - fix number of channels for gray-to-gray color transform.\n  - `djxl`: reject decoding JXL files if 'packed' representation size overflows.\n- Changes from version 0.10.4:\n  - Huffman lookup table size fix.\n  - Check height limit in modular trees.\n","status":"published","published":"2026-06-05T12:16:50Z","modified":"2026-06-06T07:30:26.5817379Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"USN-8397-1","title":"jpeg-xl vulnerability","description":"It was discovered that libjxl did not properly handle certain crafted PBM\nimages. An attacker could possibly use this issue to cause libjxl to crash,\nresulting in a denial of service, or execute arbitrary code.","status":"published","published":"2026-06-08T12:20:37Z","modified":"2026-06-08T19:04:20.127508935Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}