CVE-2026-1837CWE-805

libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2

High · published February 11, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
23.5
In the wild
Unconfirmed
What it is

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.

This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00318 · 23.5th percentile
Weakness
CWE-805 · Buffer Access with Incorrect Length Value
Published
2026-02-11T15:19Z
EPSS history
Timeline
  • 11 FEB 15:19Z
    libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2
    cvelistv5