USN-8146-1

Daniel Novomeský discovered that libjxl did not properly manage memory when decoding certain files. An attacker could use this issue to cause libjxl to crash, resulting in denial of service, or possibly execute arbitrary code.

References

Affected packages

Ubuntu:25.10 / jpeg-xl

Package

Name: jpeg-xl
Purl: pkg:deb/ubuntu/jpeg-xl?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.11.1-6ubuntu1.1

Affected versions

0.*

0.11.1-4

0.11.1-6ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libjpegxl-java",
            "binary_version": "0.11.1-6ubuntu1.1"
        },
        {
            "binary_name": "libjxl-devtools",
            "binary_version": "0.11.1-6ubuntu1.1"
        },
        {
            "binary_name": "libjxl-gdk-pixbuf",
            "binary_version": "0.11.1-6ubuntu1.1"
        },
        {
            "binary_name": "libjxl-tools",
            "binary_version": "0.11.1-6ubuntu1.1"
        },
        {
            "binary_name": "libjxl0.11",
            "binary_version": "0.11.1-6ubuntu1.1"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8146-1.json"

cves_map

{
    "cves": [
        {
            "severity": [
                {
                    "type": "CVSS_V4",
                    "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
                },
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ],
            "id": "CVE-2026-1837"
        }
    ],
    "ecosystem": "Ubuntu:25.10"
}