USN-9074-1: libjgraphx-java vulnerability

Q: What access would an attacker need to exploit this issue?

The attacker would need to supply certain XML input that the affected JGraphX component converts to an image. The provided data does not indicate any additional authentication or network-access requirements.

Published Nov 12, 2026

Updated

It was discovered that JGraphX did not disable XML external entity processing when converting certain XML input to images. An attacker could possibly use this issue to obtain sensitive information or cause a denial of service.

Affected Software

2 affected componentsFixes available

ubuntu/libjgraphx-java<2.1.0.7-1ubuntu0.16.04.1~esm1

2.1.0.7-1ubuntu0.16.04.1~esm1

ubuntu/libjgraphx-java<2.1.0.7-1ubuntu0.18.04.1~esm1

2.1.0.7-1ubuntu0.18.04.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/libjgraphx-java to a version that resolves this vulnerability.
Fixed in 2.1.0.7-1ubuntu0.16.04.1~esm1
Upgrade
Upgrade ubuntu/libjgraphx-java to a version that resolves this vulnerability.
Fixed in 2.1.0.7-1ubuntu0.18.04.1~esm1

Event History

Nov 12, 2026

Advisory Published

via OSV·08:51 PM

Data Sourced

via OSV·08:51 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What access would an attacker need to exploit this issue?

The attacker would need to supply certain XML input that the affected JGraphX component converts to an image. The provided data does not indicate any additional authentication or network-access requirements.

USN-9074-1: libjgraphx-java vulnerability

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access would an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

What access would an attacker need to exploit this issue?