Updated libjxl package fixes security vulnerabilities
Publication date: 26 Oct 2026Modification date: 26 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2025-12474 , CVE-2025-70103 , CVE-2026-1837 , CVE-2026-52584
Description
Uninitialized memory read in decoder due to incorrect optimization in
patch handling. (CVE-2025-12474)
Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM
images to the jxl::extras::DecodeImagePNM function in file
lib/extras/dec/pnm.cc. (CVE-2025-70103)
Out-of-bounds write in grayscale color transformation when using LCMS2.
(CVE-2026-1837)
Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a
local attacker to obtain sensitive information via the DecodeImageAPNG
function. (CVE-2026-52584)
References
- https://bugs.mageia.org/show_bug.cgi?id=35608
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/27TWL6UI5V63S5VG5DHCLZLSTE34XF3B/
- https://github.com/libjxl/libjxl/issues/4549
- https://www.openwall.com/lists/oss-security/2026/05/30/7
- https://github.com/libjxl/libjxl/issues/4337
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/W3QKIP6MG3FEJI72LMV2M5365WSHW4BC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBNA2RFQ3GKA2CBAINVJWJMVWBQLVXDU/
- https://ubuntu.com/security/notices/USN-8397-1
- https://lists.debian.org/debian-security-announce/2026/msg00253.html
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MFBGIBYAH7ZJ5A2WUH5SPGV5U7TZRYYU/
- https://github.com/libjxl/libjxl/issues/4803
- https://lists.debian.org/debian-security-announce/2026/msg00478.html
- https://www.cve.org/CVERecord?id=CVE-2025-12474
- https://www.cve.org/CVERecord?id=CVE-2025-70103
- https://www.cve.org/CVERecord?id=CVE-2026-1837
- https://www.cve.org/CVERecord?id=CVE-2026-52584
SRPMS
10/core
- libjxl-0.11.2-1.mga10