CVE-2026-82522: libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libjxlto a version that resolves this vulnerability.Fixed in 0.12.0 - Compensating control
If immediate upgrading is not possible, restrict access to any service that accepts untrusted JPEG XL inputs until libjxl is upgraded to 0.12.0 or later.
Event History
Frequently Asked Questions
Which deployments are affected by the size-truncation condition?
The described vulnerability applies to libjxl versions before 0.12.0 on 32-bit platforms, where a 64-bit box size can be truncated to size_t. The provided information does not establish impact on 64-bit platforms.
What must an attacker provide to trigger the issue?
An attacker needs to supply a crafted JPEG XL file to a system that decodes it with an affected libjxl version. No authentication or privileges are required, but user interaction is required according to the supplied vector.
What is the practical impact of successful exploitation?
A crafted file can cause attacker-controlled codestream bytes to be interpreted as phantom container-box headers, allowing injection of metadata such as Exif, XMP, IPTC, or JUMBF. The description also identifies potential out-of-bounds reads.
What version addresses this vulnerability?
Upgrade libjxl to version 0.12.0 or later. The issue is described as affecting versions before 0.12.0.