CVE-2026-1837 libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2

High 8.7 Published 11 Feb 2026 Updated 15 Jul 2026

A crafted file triggers an out-of-bounds write in libjxl when using LCMS2, potentially allowing code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-1837?

CVE-2026-1837 is a high-severity memory corruption vulnerability in Google libjxl, published on 11 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.

This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

Weakness: CWE-787, CWE-770, CWE-805

Which versions are affected by CVE-2026-1837?

It affects 1 product.

Linux distribution packages (1)

libjxl openSUSE:Tumbleweed All versions 0.11.2-1.1

Products include Libjxl Project Libjxl.

How do I fix CVE-2026-1837?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-1837 being exploited?

There is no known exploitation of CVE-2026-1837 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-1837, GHSA-76gx-97cq-65f5, UBUNTU-CVE-2026-1837, openSUSE-SU-2026:10271-1.