Executive brief
libjxl is a library that decodes JPEG XL image files. An integer underflow vulnerability in the container box parser allows attackers to craft malicious JPEG XL files that inject arbitrary metadata (such as Exif, XMP, or IPTC data) into decoded images. This could lead to data corruption or potential exposure of unintended information embedded in image files.
Technical details
The vulnerability is an integer underflow in libjxl's container box parser that occurs on 32-bit platforms due to truncation of 64-bit box size values to size_t. An attacker can supply a crafted JPEG XL file that exploits this type mismatch, causing the decoder to misparse codestream bytes as phantom box headers. This leads to injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads. The vulnerability requires no authentication or user interaction beyond opening a malicious file. A fix was committed in PR #4885 on 2026-07-01, which addresses the box_size type mismatch by properly handling size conversion on 32-bit platforms.
Affected products
- libjxl libjxl before 0.12
Timeline
- 2026-09-02: disclosed
- 2026-07-01: patched: Fix committed in PR #4885