Memory Corruption Vulnerability in libjxl Decoding for Image Processing
CVE-2026-1837

8.7HIGH

Key Information:

Vendor

Google
Status
Libjxl
Vendor
CVE Published:
11 February 2026

What is CVE-2026-1837?

A malformed file can exploit a vulnerability in libjxl's image decoder, leading to memory corruption. This occurs when the library processes grayscale images, where uninitialized memory can be written to due to improper handling of pixel data. Specifically, the issue arises when one-float-per-pixel buffers are accessed as if they were three-float-per-pixel buffers when using LCMS2 as the color management system. Careful migration to a different CMS engine can mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

libjxl 0.9 <= 0.11.1

References

https://github.com/libjxl/libjxl/issues/4549

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.