ZeroDay Findings
Sign inSign up

Findings

CVE-2026-52584

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Published Jul 17, 2026 · updated Oct 15, 2026 · Debian Debian

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 17, 2026 · OSV.dev

    Detected

    Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

  2. Oct 15, 2026 · OSV.dev

    Fix available

    jpeg-xl fixed in 0.11.2-0.1~deb13u3; jpeg-xl fixed in 0.11.2-5.1

  3. Oct 15, 2026 · OSV.dev

    Fix available

    jpeg-xl fixed in 0.11.2-0.1~deb13u3

  4. Oct 15, 2026 · OSV.dev

    Fix available

    jpeg-xl fixed in 0.11.2-5.1

  5. Oct 15, 2026 · OSV.dev

    Updated

    Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function

Affected

  • Debian:12 jpeg-xl0.10.3-1, 0.10.3-2, 0.10.3-3
  • Debian:13 jpeg-xl0 → 0.11.2-0.1~deb13u3
  • Debian:14 jpeg-xl0 → 0.11.2-5.1

Sources

References