Product:
libjxl
Summary
A specially-crafted file can cause libjxl’s decoder to write pixel data to uninitialized unallocated memory. This occurs when color transformation of grayscale images to another grayscale color space is requested. Buffers allocated for 1-float-per-pixel are incorrectly used as if they are allocated for 3-float-per-pixel, specifically when LCMS2 is used as the CMS engine.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2026-1837 |
Exploitation
To exploit this vulnerability, an attacker can create a specially-crafted file that triggers the decoder to mishandle pixel data. By requesting a color transformation of grayscale images, the attacker can manipulate the memory allocation process, leading to the copying of data from uninitialized regions into pixel data buffers. This can result in unexpected behavior or crashes in applications using the affected library.
Affected Products
- libjxl: A library for JPEG XL image decoding that is vulnerable when using LCMS2 as the CMS engine.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of libjxl and consider switching to a different CMS engine if possible. Regular updates and patches from the vendor should be applied to address any security issues.