CVE-2026-82522

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to sizet on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse...