CVE-2026-82522

Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.12

Description An integer underflow exists in the container box parser. On 32-bit platforms, 64-bit box sizes are truncated to size t, allowing remote attackers to provide a specially crafted JPEG XL file. This causes the decoder to interpret attacker-controlled codestream bytes as phantom box headers, which enables the injection of arbitrary metadata, such as Exif, XMP, IPTC, and JUMBF, and may lead to out-of-bounds reads.

Recommendations Update libjxl to version 0.12 or later.