What is CVE-2026-1837?

CVE-2026-1837 is a high-severity vulnerability in Google Libjxl, classified under Buffer Access with Incorrect Length Value. CVSS score: 7.5/10. Published 2026-02-11.

How severe is CVE-2026-1837?

High severity. CVSS v3 base score is 7.5 out of 10.

Buffer overflow in Google Libjxl

CVE-2026-1837

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color…

EPSS: 0.002 (9.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Google Libjxl — versions 0.9
Libjxl_project Libjxl

Weakness classification (CWE)

References

cve-coordination@google.com (Exploit, Patch, Issue Tracking)
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Frequently asked questions

What is CVE-2026-1837?: CVE-2026-1837 is a high-severity vulnerability in Google Libjxl, classified under Buffer Access with Incorrect Length Value. CVSS score: 7.5/10. Published 2026-02-11.
How severe is CVE-2026-1837?: High severity. CVSS v3 base score is 7.5 out of 10.