CVE-2026-82522: libjxl Integer Underflow RCE Vulnerability

CVE-2026-82522 Overview

CVE-2026-82522 is an integer underflow vulnerability in libjxl versions before 0.12. The flaw resides in the JPEG XL container box parser, where 64-bit box size values are truncated to size_t on 32-bit platforms. Remote attackers can supply a crafted JPEG XL file that causes the decoder to parse attacker-controlled codestream bytes as phantom box headers. This enables injection of arbitrary metadata including Exif, XMP, IPTC, and JUMBF, as well as potential out-of-bounds reads during decoding [CWE-681].

Critical Impact
Attackers can inject arbitrary metadata into decoded JPEG XL images and trigger out-of-bounds memory reads on 32-bit platforms by delivering a malicious file.

Affected Products

libjxl versions before 0.12.0
Applications on 32-bit platforms linking against vulnerable libjxl builds
Image processing pipelines and viewers consuming JPEG XL files

Discovery Timeline

2026-09-02 - CVE-2026-82522 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82522

Vulnerability Analysis

The JPEG XL container format encodes structured data using ISO base media file format boxes. Each box header declares its size as a 64-bit value. In libjxl before 0.12, the ParseBoxHeader function in lib/jxl/decode.cc passed these sizes through pointers typed as uint64_t*, while surrounding logic operated on size_t. On 32-bit platforms, size_t is 32 bits wide, and the conversion truncated the upper bits of the declared box size.

The truncated size participated in arithmetic that computes the offset to the next box header. When the attacker chose specific high-bit values, the arithmetic underflowed and produced a small or negative-looking offset. The parser then re-entered the box loop pointing inside the JPEG XL codestream rather than at a legitimate box boundary. Bytes controlled by the attacker inside the codestream became phantom box headers, allowing injection of Exif, XMP, IPTC, or JUMBF metadata boxes.

Root Cause

The root cause is a numeric truncation error [CWE-681] between a 64-bit box size and a 32-bit size_t. The patch changes the box_size and header_size output parameters of ParseBoxHeader from uint64_t* to size_t* and adds explicit bounds validation, ensuring the parser cannot advance past the input buffer or underflow computed offsets.

Attack Vector

Exploitation requires an attacker to deliver a crafted JPEG XL file to a target running libjxl on a 32-bit platform. User interaction is required, typically opening the file in an image viewer, browser, or thumbnailer that invokes libjxl. No authentication is required.

text

// Patch excerpt: lib/jxl/decode.cc
 static JxlDecoderStatus ParseBoxHeader(const uint8_t* in, size_t size,
                                        size_t pos, size_t file_pos,
-                                       JxlBoxType type, uint64_t* box_size,
-                                       uint64_t* header_size) {
+                                       JxlBoxType type, size_t* box_size,
+                                       size_t* header_size) {
   if (OutOfBounds(pos, 8, size)) {
     *header_size = 8;
     return JXL_DEC_NEED_MORE_INPUT;
// Source: https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68

Detection Methods for CVE-2026-82522

Indicators of Compromise

JPEG XL files containing box size fields with high 32-bit values that overflow when truncated to size_t.
Unexpected Exif, XMP, IPTC, or JUMBF metadata appearing after decoding a JPEG XL image.
Application crashes or memory read faults in processes linked against pre-0.12 libjxl on 32-bit systems.

Detection Strategies

Inventory installed libjxl versions across endpoints and build systems; flag any version below 0.12.0.
Parse inbound JPEG XL files at the gateway and reject files whose declared box sizes exceed the file length or the platform size_t range.
Correlate decoder crash telemetry with recent JPEG XL file access to identify targeted delivery.

Monitoring Recommendations

Monitor image processing services and browsers on 32-bit hosts for abnormal termination when handling .jxl files.
Log and alert on JPEG XL files delivered through email, web downloads, and file shares to high-value users.
Track application dependency manifests in CI/CD for pinned libjxl versions below 0.12.0.

How to Mitigate CVE-2026-82522

Immediate Actions Required

Upgrade libjxl to version 0.12.0 or later across all systems, packages, and application bundles.
Rebuild and redistribute any downstream software that statically links libjxl.
Prioritize patching on 32-bit platforms where the truncation is exploitable.

Patch Information

The fix is included in the libjxl v0.12.0 release and delivered via pull request #4885. The corrective commit 22ad80a changes ParseBoxHeader size parameters to size_t and adds bounds checks. Additional analysis is available in the VulnCheck Security Advisory.

Workarounds

Disable JPEG XL decoding in browsers and image viewers until libjxl is upgraded.
Restrict acceptance of .jxl files at email and web proxies through content-type and file extension filtering.
Where feasible, move image processing workloads to 64-bit hosts, where the truncation does not occur.

bash

# Verify installed libjxl version
dpkg -l | grep libjxl
pkg-config --modversion libjxl

# Upgrade on Debian/Ubuntu once 0.12.0+ is packaged
sudo apt update && sudo apt install --only-upgrade libjxl0.12 libjxl-tools

# Build from source at the fixed release
git clone --branch v0.12.0 --recursive https://github.com/libjxl/libjxl.git
cd libjxl && cmake -B build -DCMAKE_BUILD_TYPE=Release && cmake --build build