==========================================================================
Ubuntu Security Notice USN-8146-1
April 02, 2026

jpeg-xl vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10

Summary:

libjxl could be made to crash or run programs as your login if it
opened a specially crafted file.

Software Description:
- jpeg-xl: Reference codec implementation for JPEG XL compressed raster image format

Details:

Daniel Novomesk� discovered that libjxl did not properly manage memory when
decoding certain files. An attacker could use this issue to cause
libjxl to crash, resulting in denial of service, or possibly execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  libjpegxl-java                  0.11.1-6ubuntu1.1
  libjxl-tools                    0.11.1-6ubuntu1.1
  libjxl0.11                      0.11.1-6ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8146-1
  CVE-2026-1837

Package Information:
  https://launchpad.net/ubuntu/+source/jpeg-xl/0.11.1-6ubuntu1.1