Integer Underflow Vulnerability in libjxl Container Box Parser

CVE-2026-82522

What is CVE-2026-82522?

The libjxl library is susceptible to an integer underflow in the container box parser, which allows remote attackers to inject arbitrary metadata into JPEG XL files. By exploiting a 64-bit box size truncation when parsing on 32-bit systems, attackers can manipulate the decoder to interpret crafted bytes as phantom box headers. This vulnerability can lead to the injection of various metadata types, such as Exif, XMP, IPTC, and JUMBF, and may cause potential out-of-bounds reads, resulting in further security risks.

References