DEBIAN-CVE-2026-1837
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).
DEBIAN-CVE-2026-1837
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-1837
jpeg-xl
Source reference: /affected/0/package/name
- Affected versions
- 0.11.1-4
Source reference:
/affected/0/versions0.11.1-5Source reference:
/affected/0/versions0.11.1-6Source reference:
/affected/0/versions - Fixed versions
- 0.11.2-0.1~deb13u1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
jpeg-xl
Source reference: /affected/1/package/name
- Affected versions
- 0.11.1-4
Source reference:
/affected/1/versions0.11.1-5Source reference:
/affected/1/versions0.11.1-6Source reference:
/affected/1/versions0.11.2-0.1~deb13u1Source reference:
/affected/1/versions0.11.2-0.1~deb13u2Source reference:
/affected/1/versions - Fixed versions
- 0.11.2-0.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.2-0.1~deb13u1"
}
]
}
],
"package": {
"name": "jpeg-xl",
"purl": "pkg:deb/debian/jpeg-xl?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"0.11.1-4",
"0.11.1-5",
"0.11.1-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-1837.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.2-0.1"
}
]
}
],
"package": {
"name": "jpeg-xl",
"purl": "pkg:deb/debian/jpeg-xl?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.11.1-4",
"0.11.1-5",
"0.11.1-6",
"0.11.2-0.1~deb13u1",
"0.11.2-0.1~deb13u2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-1837.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55565 · Revision 1
- Added to Heist Feed
- Publisher date