Vulnerability · NVD

CVE-2026-1837

CVE-2026-1837 : high severity (CVSS 7.5). No tracked catalog app is linked to this CVE.

Severity (CVSS): 7.5
Exploitation: 0.3 %
Tracked apps: 0
Still exposed: 0

Published on 2026-02-11

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.

This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

Attack vector : Network No privileges required No user interaction

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS 0.29% exploit very unlikely percentile 18.8%

OS versions that fix this CVE

This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.

iOS Fixed in 26.5
iPadOS Fixed in 26.5
macOS Fixed in 26.5

View on NVD ↗ Advisory · github.com

Manage your fleet with Appaloosa

Appaloosa pushes OS updates, apps and policies to your Windows, macOS, iOS and Android devices from one console.

Discover Appaloosa MDM