SUSE-SU-2026:5131-1: Security update for libjxl

Q: Which deployments are exposed to this issue?

The issue is described as affecting libjxl on 32-bit systems, where a 64-bit box size can be truncated. The listed SUSE Package Hub 15 SP7 package architectures are aarch64, ppc64le, s390x, and x86_64.

Q: What input is required for exploitation?

An attacker would need content processed by libjxl that uses a 64-bit box size in a way that triggers truncation on a 32-bit system. The resulting integer underflow can cause phantom box parsing and arbitrary metadata injection.

Published Nov 9, 2026

Updated

This update for libjxl fixes the following issue:

- CVE-2026-82522: integer underflow via 64-bit box size truncation on 32-bit systems can lead to phantom box parsing and arbitrary metadata injection (bsc#1278308).

Other sources

This update for libjxl fixes the following issue: CVE-2026-82522: integer underflow via 64-bit box size truncation on 32-bit systems can lead to phantom box parsing and arbitrary metadata injection (bsc#1278308).

— SUSE

Affected Software

7 affected componentsFixes available

suse/libjxl<0.10.5-150700.4.15.1

0.10.5-150700.4.15.1

All of the following

SUSE SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/libjxl-devel<0.10.5-150700.4.15.1

0.10.5-150700.4.15.1

suse/libjxl-tools-debuginfo<0.10.5-150700.4.15.1

0.10.5-150700.4.15.1

suse/libjxl-debugsource<0.10.5-150700.4.15.1

0.10.5-150700.4.15.1

suse/libjxl-tools<0.10.5-150700.4.15.1

0.10.5-150700.4.15.1

SUSE SUSE Package Hub 15 15-SP7 (x86_64)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/libjxl to a version that resolves this vulnerability.
Fixed in 0.10.5-150700.4.15.1
Upgrade
Upgrade suse/libjxl-devel to a version that resolves this vulnerability.
Fixed in 0.10.5-150700.4.15.1
Upgrade
Upgrade suse/libjxl-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 0.10.5-150700.4.15.1
Upgrade
Upgrade suse/libjxl-debugsource to a version that resolves this vulnerability.
Fixed in 0.10.5-150700.4.15.1
Upgrade
Upgrade suse/libjxl-tools to a version that resolves this vulnerability.
Fixed in 0.10.5-150700.4.15.1
Upgrade
Upgrade libjxl to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-5131

Event History

Nov 9, 2026

Advisory Published

via OSV·09:14 AM

Data Sourced

via OSV·09:14 AM

DescriptionAffected Software

Advisory Published

via SUSE·09:14 AM

Data Sourced

via SUSE·09:14 AM

RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-82522

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue is described as affecting libjxl on 32-bit systems, where a 64-bit box size can be truncated. The listed SUSE Package Hub 15 SP7 package architectures are aarch64, ppc64le, s390x, and x86_64.

What input is required for exploitation?

An attacker would need content processed by libjxl that uses a 64-bit box size in a way that triggers truncation on a 32-bit system. The resulting integer underflow can cause phantom box parsing and arbitrary metadata injection.

SUSE-SU-2026:5131-1: Security update for libjxl

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What input is required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What input is required for exploitation?