CVE-2026-82522

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82522
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82522.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82522
Downstream
Published
2026-09-02T17:37:47Z
Modified
2026-10-28T11:18:14Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation
Details

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-681"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82522.json"
}
References

Affected packages

Git / github.com/libjxl/libjxl

Affected ranges

Type
GIT
Repo
https://github.com/libjxl/libjxl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a7a9c787341cf703dede03c2009fa460cae5e5df
Fixed
22ad80af1454f0444ea34115e49ed40517147d68
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.12.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "v0.12.0",
            "range": [
                {
                    "fixed": "a7a9c787341cf703dede03c2009fa460cae5e5df"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "fixed": "22ad80af1454f0444ea34115e49ed40517147d68"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*
v0.1
v0.1.0
v0.1.1
v0.10-snapshot
v0.11-snapshot
v0.2
v0.2.0
v0.3
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.5-base
v0.6-base
v0.7-base
v0.7rc
v0.8-snapshot
v0.9-snapshot

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82522.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "172785358831948890464630007747736342725",
            "length": 725
        },
        "id": "CVE-2026-82522-091db0cb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/decode.cc",
            "function": "ParseBoxHeader"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "81342315574233078093304768462675502035",
            "length": 1747
        },
        "id": "CVE-2026-82522-0aaeaf60",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/dec_frame.cc",
            "function": "FrameDecoder::ProcessDCGlobal"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "290241923242118120454835673407121687337",
                "280532179843439803573766225184687771956",
                "291419656687509259886305783110143270465",
                "124972039722827211291145228060884131772",
                "129112404469475761700432880176850541404",
                "278070552867383092240491656293194169241",
                "196152926197787281327914216516171344361",
                "212169318341325995803147305695766789545",
                "60515781544041951728854614918740569612",
                "70938208180435769728766660472274103109",
                "11458782798279051498203191028648397389",
                "19941739944195219511218144998400591103",
                "244294795225457216529824444211182081187",
                "22502662876642342536644723871443057266",
                "307656967185783599085308084354049379355"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82522-0f846756",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/decode.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "277118696555876291323029314700907295093",
                "76720683743465011866880659500710427436",
                "73162532132294667238284635959222044284",
                "127933711401675286481648700847680875034",
                "187205843104753074326454873824518696719",
                "241869751895048028976563457233159718161",
                "292401772408340742962025834222415273861",
                "248602947827809720821514498820662997620",
                "71465303972460055585570748442537702393",
                "96782358904924953199266782185722495262",
                "74157325397606115271436435301920920347",
                "201897347749886119980135356382801518359",
                "83029428632244559226873752584655433969",
                "299792681971697806366494203361426682372",
                "99021942043912325851770467649706994797",
                "65385401328684258461237902105999035629",
                "260715042990849794782468876700678748100",
                "161220606798816201478824570527889948757",
                "159999747392014330434835368902590449816"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82522-27db3128",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/enc_fast_lossless.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "236646337053854284035185280914095255043",
                "65226485504875948821365416646531645371",
                "320075085305017756942793737654190502677",
                "13784146230144537288106909684071227812"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82522-2e113ae2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/render_pipeline/render_pipeline_stage.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "299199990060124370914364935204905358548",
                "33204445684706782638895372389353452376",
                "103235779106116370604841900829023913313",
                "35484464395286698550711345069063841744",
                "134791264693843007208693305485628002255",
                "85936604334611935729837470504896414969",
                "221915165111196427685717478391953362072",
                "107909427710775207241648388802763658783",
                "213397401751548187869147448502061435195"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82522-88ff0636",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/render_pipeline/stage_upsampling.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "70579719139130785625286118524925623630",
            "length": 1853
        },
        "id": "CVE-2026-82522-94c509ad",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/enc_fast_lossless.cc",
            "function": "PrepareDCGlobalCommon"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "154531005489670439437416140428853273904",
                "148071549962730863676589927081036137039",
                "63239478678986890176263643886207495497",
                "256426840547422346899763358151216750298",
                "75147458254790278871552565603295123017",
                "222792565002881104864093879228567588869",
                "83384017442619419839846687858358022183",
                "40281014207192137090063761867611554275",
                "169048645903097351238732638761885580171",
                "131799868617833010831186928835517894234",
                "167618757022247747423338131166436064530",
                "2544430322066124415996259175243664304"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82522-a43d9b51",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/jpeg/jpeg_data.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "302561896715636321415718457165700989062",
            "length": 12013
        },
        "id": "CVE-2026-82522-ad82095f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/jpeg/jpeg_data.cc",
            "function": "JPEGData::VisitFields"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "184645233657072963285521022666705815971",
                "147924616371849410610441024351494462664",
                "241563678705130281893997507142534375895",
                "233656359156659683795846205523064670320",
                "114947371990692676782833465463964425892",
                "26542594251787271608055798620665849714",
                "270519963145808539075031538331661617166",
                "147579352647101241522439979005905804658"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-82522-d0e4aea5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68",
        "target": {
            "file": "lib/jxl/dec_frame.cc"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:18:14Z"