CVE-2026-82522 in libjxl
Summary
by MITRE • 09/02/2026
libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in libjxl versions prior to 0.12 represents a critical integer underflow condition within the container box parser component of the JPEG XL decoding library. This flaw specifically manifests on 32-bit platforms where there is a type mismatch between the native size_t data structure and larger integer types used for parsing file metadata. When processing crafted JPEG XL files, the decoder attempts to parse box sizes that are defined as 64-bit integers in the container format specification. On systems with 32-bit pointers and address spaces, this conversion from a large unsigned 64-bit value to an unsigned 32-bit size_t results in truncation rather than proper validation or error handling. This arithmetic anomaly effectively creates an integer underflow scenario where legitimate large box sizes are reduced to small positive values that the parser interprets as valid container structures.
The operational impact of this vulnerability is severe, allowing remote attackers to inject arbitrary metadata into processed images by exploiting these truncated size fields. By carefully crafting a JPEG XL file with specific header configurations, an attacker can cause the decoder to misinterpret subsequent codestream bytes or adjacent memory regions as phantom box headers. This misalignment enables the injection of malicious data structures such as Exif, XMP, IPTC, and JUMBF metadata blocks that are not part of the original image content. The ability to inject arbitrary metadata poses significant risks for applications relying on these fields for indexing, searchability, or digital rights management, potentially leading to information leakage or manipulation of application logic that trusts embedded metadata without sufficient validation.
Beyond metadata injection, this vulnerability facilitates potential out-of-bounds reads within the memory space allocated by the decoder. Because the parser operates under the false assumption that a truncated size represents a valid box boundary, it may attempt to read data beyond the intended buffer limits when processing subsequent fields or attempting to validate the structure of these phantom boxes. This can lead to information disclosure if sensitive data residing in adjacent memory locations is exposed through error messages, logs, or application responses. In more complex exploitation scenarios involving further parsing logic errors, such out-of-bounds access could potentially be leveraged for code execution, although the primary documented impact remains focused on metadata injection and potential read-based side-channel attacks.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, specifically manifesting as an underflow due to truncation during type conversion. It also relates closely to CWE-20 Improper Input Validation, as the parser fails to adequately verify that the converted size fits within the expected bounds for a 32-bit environment before proceeding with parsing operations. In terms of attack vectors and techniques, this flaw is consistent with ATT&CK technique T1558 which involves Silent Authentication or Steal Web Session Cookie through manipulation of authentication mechanisms via metadata injection, although in this context it more broadly applies to data integrity violations under the broader category of input validation failures. The vulnerability highlights the critical importance of explicit size checks and platform-specific type safety when implementing parsers for complex binary formats like JPEG XL that support large container structures.
Mitigation strategies primarily involve upgrading libjxl to version 0.12 or later, where this specific truncation issue has been addressed through improved type handling and validation logic in the box parser. For environments unable to immediately upgrade, defensive programming practices should be implemented at the application layer by validating image inputs before passing them to the decoder library. This includes checking file sizes against expected limits and ensuring that any custom parsing wrappers enforce strict bounds on metadata fields derived from external sources. Additionally, deploying runtime protection mechanisms such as Address Space Layout Randomization (ASLR) can mitigate the risk of exploitation leading to code execution by making memory layout unpredictable for attackers attempting to leverage out-of-bounds reads or other secondary effects stemming from this initial integer underflow condition.