CVE-2026-82522
libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.
| CWE | CWE-681 |
| Vendor | libjxl |
| Product | libjxl |
| Published | Sep 2, 2026 |
| Last Updated | Oct 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for libjxl libjxl
Be the first to know when new medium vulnerabilities affecting libjxl libjxl are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
libjxl / libjxl
0 < 0.12.0
References
github.com: https://github.com/libjxl/libjxl/releases/tag/v0.12.0 github.com: https://github.com/libjxl/libjxl/pull/4885 github.com: https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68 vulncheck.com: https://www.vulncheck.com/advisories/libjxl-container-box-parser-integer-underflow-via-32-bit-size-truncation
Credits
Ali Raza (@locus-x64)