CVE-2026-1837: google libjxl

Vulnerability summary

CVE-2026-1837 is a high (CVSS 8.8) vulnerability in google libjxl. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-02-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

• CWE-805Buffer Access with Incorrect Length ValueThe product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.