Executive brief
libjxl is an open-source library used for encoding and decoding JPEG XL images. A security flaw was discovered where the library incorrectly handles certain animated PNG (APNG) files, which could allow a local attacker to access sensitive information from the computer's memory. This could lead to the exposure of private data or help an attacker bypass other security protections on the system.
Technical details
A heap-based buffer overflow vulnerability exists in libjxl's APNG decoding logic within the `DecodeImageAPNG` function in `lib/extras/dec/apng.cc`. The flaw is triggered when the library fails to properly validate `frameRaw.rows` bounds before memory access during the decoding of an animated PNG. A local attacker can exploit this by providing a specially crafted APNG file to an application using the library (such as the `cjxl` tool). This results in an out-of-bounds read, potentially leaking sensitive information from the heap. A fix was submitted in pull request #4804 involving improved bounds validation.
Affected products
- libjxl libjxl v0.11.2 and earlier
Timeline
- 2026-05-26: disclosed: Issue reported on GitHub
- 2026-05-27: patched: Fix submitted and approved via pull request
- 2026-07-17: advisory: CVE published to NVD