CVE Tools
Track your stack

Libjxl

14 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Libjxl, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Libjxl CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Libjxl CVEs per month
MonthCVEs
2024-112
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-022
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-091
2026-100

Severity

How the 14 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical214%
  • High429%
  • Medium857%

Latest CVEs

The 14 most recently published vulnerabilities affecting Libjxl.

  1. CVE-2026-82522libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation5.4
  2. CVE-2025-12474libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling4.4
  3. CVE-2026-1837libjxl: Out-of-bounds write in grayscale color transformation when using LCMS27.5
  4. CVE-2024-11403Out of Bounds Memory Read/Write in libjxl9.8
  5. CVE-2024-11498Resource exhaustion via Stack overflow in libjxl7.5
  6. CVE-2023-35790An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop.7.5
  7. CVE-2023-0645Out of Bounds read in libjxl5.3
  8. CVE-2022-34000libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init() in render_pipeline/low_memory_render_pipeline.cc.6.5
  9. CVE-2021-45928libjxl b02d6b9, as used in libvips 8.11 through 8.11.2 and other products, has an out-of-bounds write in jxl::ModularFrameDecoder::DecodeGroup (called from jxl::FrameDecoder::ProcessACGroup and jxl...5.5
  10. CVE-2021-22564Out of bounds Copy in Libjxl in large image groups4.5
  11. CVE-2021-22563Memory Overread in libjxl4.5
  12. CVE-2021-36692libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). When encoding a malicous APNG file using cjxl, an attacker can trigger a denial of service.6.5
  13. CVE-2021-36691libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase(). When encoding a malicous GIF file using cjxl, an attacker can trigger a denial of service.7.5
  14. CVE-2021-27804JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory corruption.9.8

Product grouping is registry-driven, with AI assist and human review. How it works