EUVD-2026-70241
GHSA-8q4m-qc33-25q8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H captures the 32-bit platform prerequisite; UI:R reflects the requirement for a user or process to parse the crafted file; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.
AnalysisAI
Integer underflow in libjxl's container box parser before v0.12.0 allows unauthenticated remote attackers to inject arbitrary image metadata into JPEG XL files decoded on 32-bit platforms. The flaw arises from silent truncation of 64-bit ISOBMFF-style box sizes to the narrower size_t type, causing the decoder to misinterpret attacker-controlled codestream bytes as phantom box headers and insert forged Exif, XMP, IPTC, or JUMBF metadata blocks into its internal state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: (1) the target must be running a 32-bit build of libjxl where size_t is 4 bytes - standard 64-bit deployments are not vulnerable to the size truncation; (2) a user or automated process must supply and decode the attacker-crafted JPEG XL file (UI:P per the CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) is consistent with the described impact envelope: both confidentiality and integrity effects are Low, availability is unaffected, and user participation is required (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade libjxl to version 0.12.0 or later, which incorporates the fix via commit 22ad80af1454f0444ea34115e49ed40517147d68 (PR #4885, https://github.com/libjxl/libjxl/pull/4885); the patched release is at https://github.com/libjxl/libjxl/releases/tag/v0.12.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase(). Rated high severi
libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init() in render_pipeline/low_memory_render_pipeline.c
libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). Rated medium
JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory corruption. Rated critical severity (CVSS 9.8), this vulnerab
For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when proc
An out of bounds read exists in libjxl. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable,
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after
Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering sp
An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2. Rated high severity (CVSS 7.5), this vulnerab
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This c
Same weakness CWE-681 – Incorrect Conversion between Numeric Types
View allShare
External POC / Exploit Code
Leaving vuln.today