CVE-2026-82522
Received Received - Intake

Integer Underflow in libjxl JPEG XL Parser

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-82522
EUVD
EUVD-2026-70241

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libjxl libjxl to 0.12 (exc)
libjxl libjxl to 0.12.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-681 When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer underflow in the container box parser of libjxl versions before 0.12.0. It allows remote attackers to inject arbitrary metadata into JPEG XL files by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers craft a JPEG XL file that causes the decoder to misinterpret codestream bytes as phantom box headers, enabling metadata injection such as Exif, XMP, IPTC, or JUMBF, and potentially leading to out-of-bounds reads.

Detection Guidance

To detect this vulnerability, check the installed version of libjxl on your system. Run: libjxl --version or check package managers like apt list --installed | grep libjxl. If the version is below 0.12.0, the system is vulnerable. Additionally, monitor network traffic for suspicious JPEG XL files being processed.

Impact Analysis

This vulnerability could allow attackers to inject malicious metadata into JPEG XL files you process. If you use vulnerable libjxl versions to decode images, attackers might embed harmful data like Exif or XMP tags that could trigger further exploits. It may also cause crashes or unexpected behavior due to out-of-bounds reads in the decoder.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary metadata injection (Exif, XMP, IPTC, JUMBF) through crafted JPEG XL files. Such metadata manipulation may violate data integrity and confidentiality requirements under these regulations, particularly if sensitive personal or health information is embedded or altered without authorization.

Mitigation Strategies

Immediately update libjxl to version 0.12.0 or later. For Linux systems, use: sudo apt update && sudo apt upgrade libjxl. Avoid processing untrusted JPEG XL files until patched. If updating is not possible, disable JPEG XL support in applications or block related file types at the network level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82522. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart