Bug#1128067: jpeg-xl: CVE-2026-1837

[Salvatore Bonaccorso]

Source: jpeg-xl
Version: 0.11.1-6
Severity: important
Tags: security upstream
Forwarded: https://github.com/libjxl/libjxl/issues/4549
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for jpeg-xl.

CVE-2026-1837[0]:
| A specially-crafted file can cause libjxl's decoder to write pixel
| data to uninitialized unallocated memory. Soon after that data from
| another uninitialized unallocated region is copied to pixel data.
| This can be done by requesting color transformation of grayscale
| images to another grayscale color space. Buffers allocated for
| 1-float-per-pixel are used as if they are allocated for 3-float-per-
| pixel. That happens only if LCMS2 is used as CMS engine. There is
| another CMS engine available (selected by build flags).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-1837
    https://www.cve.org/CVERecord?id=CVE-2026-1837
[1] https://github.com/libjxl/libjxl/issues/4549

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore