{"id":"CVE-2026-1837","aliases":["ALPINE-CVE-2026-1837","DEBIAN-CVE-2026-1837","EUVD-2026-6177","GHSA-76gx-97cq-65f5","MGASA-2026-0548","SUSE-SU-2026:0648-1","SUSE-SU-2026:20903-1","UBUNTU-CVE-2026-1837","USN-8146-1","openSUSE-SU-2026:10271-1","openSUSE-SU-2026:20385-1"],"status":"published","title":"libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2","description":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.\n\nThis can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00325,"percentile":0.25801,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770","CWE-787","CWE-805"],"published":"2026-02-11T15:19:55Z","modified":"2026-11-03T06:33:01Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"libjxl","fixed_in":["0.11.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jpeg-xl","fixed_in":["0.11.2-0.1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jpeg-xl","fixed_in":["0.11.2-0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"jpeg-xl","fixed_in":["0.11.1-6ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libjxl","fixed_in":["0.11.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.9.0"},{"fixed":"0.11.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-0.1~deb13u1"}]}],"versions":["0.11.1-4","0.11.1-5","0.11.1-6"]},{"source":"osv","ecosystem":"Debian:14","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-0.1"}]}],"versions":["0.11.1-4","0.11.1-5","0.11.1-6","0.11.2-0.1~deb13u1","0.11.2-0.1~deb13u2"]},{"source":"osv","ecosystem":"Mageia:10","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-150700.4.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-6ubuntu1.1"}]}],"versions":["0.11.1-4","0.11.1-6ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jpeg-xl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.1-6ubuntu1.1"}]}],"versions":["0.11.1-4","0.11.1-6ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libjxl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.2-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"google","product":"libjxl"},{"vendor":"libjxl_project","product":"libjxl"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://github.com/libjxl/libjxl/issues/4549","tags":["exploit","Exploit","Issue Tracking","Patch","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1837","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2438974","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1837.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1837","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-76gx-97cq-65f5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-1837","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1837.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-1837","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0548.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35608","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27TWL6UI5V63S5VG5DHCLZLSTE34XF3B/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/30/7","tags":["web"]},{"url":"https://github.com/libjxl/libjxl/issues/4337","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/W3QKIP6MG3FEJI72LMV2M5365WSHW4BC/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBNA2RFQ3GKA2CBAINVJWJMVWBQLVXDU/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8397-1","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00253.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MFBGIBYAH7ZJ5A2WUH5SPGV5U7TZRYYU/","tags":["web"]},{"url":"https://github.com/libjxl/libjxl/issues/4803","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00478.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260648-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258090","tags":["report"]},{"url":"https://bugzilla.suse.com/1258091","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1837","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620903-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-1837","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1837","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8146-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-1837","title":"libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2","description":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.\n\nThis can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).","status":"published","published":"2026-02-11T15:19:55.442Z","modified":"2026-07-15T01:21:04.474Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-805","CWE-787"],"updated_at":"2026-11-02T14:20:01.271368Z"}],"euvd":[{"id":"EUVD-2026-6177","description":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.\n\nThis can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).","status":"published","published":"2026-02-11T15:19:55Z","modified":"2026-07-15T01:21:04Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:19:55.318488Z"}],"ghsa":[{"id":"GHSA-76gx-97cq-65f5","title":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized...","description":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.\n\nThis can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).","status":"published","published":"2026-02-11T18:31:28Z","modified":"2026-06-30T03:35:34Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770","CWE-787","CWE-805"],"updated_at":"2026-11-02T15:09:04.017394Z"}],"nvd":[{"id":"CVE-2026-1837","description":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.\n\nThis can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).","status":"published","published":"2026-02-11T16:16:04.697Z","modified":"2026-07-15T02:18:21.22Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-805","CWE-770","CWE-787"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"ALPINE-CVE-2026-1837","description":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.\n\nThis can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).","status":"published","published":"2026-02-11T16:16:04.697Z","modified":"2026-11-03T06:33:01.498480755Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-1837","title":"libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2","description":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.\n\nThis can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).","status":"published","published":"2026-02-11T15:19:55.442Z","modified":"2026-10-28T02:31:08.422534215Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-805"],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"DEBIAN-CVE-2026-1837","description":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.  This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).","status":"published","published":"2026-02-11T16:16:04.697Z","modified":"2026-10-01T03:02:30.102371125Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"UBUNTU-CVE-2026-1837","description":"A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).","status":"published","published":"2026-02-11T16:16:00Z","modified":"2026-06-30T18:16:43.413850919Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"MGASA-2026-0548","title":"Updated libjxl package fixes security vulnerabilities","description":"Uninitialized memory read in decoder due to incorrect optimization in\npatch handling. (CVE-2025-12474)\nHeap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM\nimages to the jxl::extras::DecodeImagePNM function in file\nlib/extras/dec/pnm.cc. (CVE-2025-70103)\nOut-of-bounds write in grayscale color transformation when using LCMS2.\n(CVE-2026-1837)\nBuffer Overflow vulnerability in libjxl v.0.11.2 and before allows a\nlocal attacker to obtain sensitive information via the DecodeImageAPNG\nfunction. (CVE-2026-52584)\n","status":"published","published":"2026-10-26T15:28:20Z","modified":"2026-10-26T15:30:03.184451351Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10271-1","title":"libjxl-devel-0.11.2-1.1 on GA media","description":"These are all security issues fixed in the libjxl-devel-0.11.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-27T00:00:00Z","modified":"2026-03-23T04:54:38.189935Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20385-1","title":"Security update for libjxl","description":"This update for libjxl fixes the following issues:\n\nUpdate to libjxl 0.11.2:\n\n- CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory\n  (bsc#1258090).\n- CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memory\n  (bsc#1258091).\n","status":"published","published":"2026-03-18T10:13:37Z","modified":"2026-03-26T17:23:49.037918Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0648-1","title":"Security update for libjxl","description":"This update for libjxl fixes the following issues:\n\n- CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory\n  (bsc#1258090).\n- CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memory\n  (bsc#1258091).\n","status":"published","published":"2026-02-25T16:30:57Z","modified":"2026-02-26T16:17:05.769128Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20903-1","title":"Security update for libjxl","description":"This update for libjxl fixes the following issues:\n\nUpdate to libjxl 0.11.2:\n\n- CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory\n  (bsc#1258090).\n- CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memory\n  (bsc#1258091).\n","status":"published","published":"2026-03-18T10:12:38Z","modified":"2026-04-02T17:31:34.208152Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-8146-1","title":"jpeg-xl vulnerability","description":"Daniel Novomeský discovered that libjxl did not properly manage memory when\ndecoding certain files. An attacker could use this issue to cause\nlibjxl to crash, resulting in denial of service, or possibly execute\narbitrary code.","status":"published","published":"2026-04-02T19:09:19Z","modified":"2026-06-30T18:15:39.034761213Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}