PatchTheCVElibjxl vulnerabilities and fixes
Recent CVEs affecting libjxl, with upgrade or downgrade steps. 4 tracked.
libjxl has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-02-11. Highest priority: CVE-2024-11403 (score 52/100).
- CVE-2026-1837 HIGH 7.5 UPGRADE A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory
- CVE-2025-12474 MEDIUM 4.4 UPGRADE A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memo
- CVE-2024-11498 HIGH 7.5 UPGRADE There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to u
- CVE-2024-11403 CRITICAL 9.8 UPGRADE There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33
FAQ
How do I fix libjxl vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libjxl being exploited right now?
None of the tracked libjxl CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libjxl CVE should I patch first?
CVE-2024-11403 currently ranks highest (52/100): There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33.