MGASA-2026-0548

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0548.html
Import Source
https://advisories.mageia.org/MGASA-2026-0548.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0548
Upstream
CVE (4)
Published
2026-10-26T15:28:20Z
Modified
2026-10-26T15:30:03Z
Summary
Updated libjxl package fixes security vulnerabilities
Details

Uninitialized memory read in decoder due to incorrect optimization in patch handling. (CVE-2025-12474) Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc. (CVE-2025-70103) Out-of-bounds write in grayscale color transformation when using LCMS2. (CVE-2026-1837) Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function. (CVE-2026-52584)

References
Credits

Affected packages

Mageia:10 / libjxl

Package

Name
libjxl
Purl
pkg:rpm/mageia/libjxl?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.11.2-1.mga10

Ecosystem specific 

{
    "section":  "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0548.json"