Executive brief
libjxl is a software library used to encode and decode JPEG XL images. A vulnerability in how it handles certain grayscale images could allow an attacker to crash applications using the library or potentially execute unauthorized code. This occurs when a specially crafted image file is processed, which could lead to data corruption or a complete service outage.
Technical details
An out-of-bounds write vulnerability (CWE-787/CWE-805) exists in libjxl's decoder when processing grayscale images. The issue occurs during color transformation from one grayscale color space to another, specifically when the LCMS2 CMS engine is utilized. The root cause is a buffer management error where buffers allocated for 1-float-per-pixel are incorrectly treated as 3-float-per-pixel allocations. An attacker can exploit this by providing a specially crafted JXL file, leading to memory corruption or a crash. The vulnerability affects versions 0.9.0 through 0.11.1.
Affected products
- Google libjxl 0.9.0 to 0.11.1
Timeline
- 2026-02-11: disclosed
- 2026-02-11: advisory