CVE-2026-1837 Details
Description
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).
A vulnerability in the libjxl decoder allows a specially-crafted file to cause the decoder to write pixel data to uninitialized, unallocated memory. This issue arises when color transformation is requested for grayscale images, using LCMS2 as the color management system (CMS) engine. The vulnerability exploits a mismatch in buffer allocation, where buffers intended for single-float-per-pixel data are incorrectly treated as triple-float-per-pixel. The problem can be reproduced by using the 'JxlDecoderSetCms' and 'JxlDecoderSetPreferredColorProfile' functions with certain grayscale JPEG XL files.
Users can update to the latest version of libjxl, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-1837 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2438974 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1837.json | redhat-SADP | |
| https://github.com/libjxl/libjxl/issues/4549 | CISA-ADP | ExploitIssue TrackingPatch |
| https://github.com/libjxl/libjxl/issues/4549 | [email protected] | ExploitIssue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-787 | Out-of-bounds Write | redhat-SADP |
| CWE-805 | Buffer Access with Incorrect Length Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libjxl project libjxl | >= 0.9.0, <= 0.11.1 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | Initial Analysis | [email protected] |
| Feb 11, 2026 | CVE Modified | CISA-ADP |
| Feb 11, 2026 | New CVE Received | [email protected] |