Amazon Linux 2023 Security Advisory: ALAS2023-2026-1459
Advisory Released Date: 2026-03-05
Advisory Updated Date: 2026-03-05
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas. (CVE-2025-12474)
A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.
This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags). (CVE-2026-1837)
Affected Packages:
jpegxl
Issue Correction:
Run dnf update jpegxl --releasever 2023.10.20260302 or dnf update --advisory ALAS2023-2026-1459 --releasever 2023.10.20260302 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
libjxl-utils-debuginfo-0.10.3-55.amzn2023.aarch64
libjxl-devtools-debuginfo-0.10.3-55.amzn2023.aarch64
jxl-pixbuf-loader-debuginfo-0.10.3-55.amzn2023.aarch64
jpegxl-debuginfo-0.10.3-55.amzn2023.aarch64
libjxl-0.10.3-55.amzn2023.aarch64
libjxl-utils-0.10.3-55.amzn2023.aarch64
libjxl-devel-0.10.3-55.amzn2023.aarch64
libjxl-debuginfo-0.10.3-55.amzn2023.aarch64
libjxl-devtools-0.10.3-55.amzn2023.aarch64
jxl-pixbuf-loader-0.10.3-55.amzn2023.aarch64
jpegxl-debugsource-0.10.3-55.amzn2023.aarch64
noarch:
jpegxl-doc-0.10.3-55.amzn2023.noarch
src:
jpegxl-0.10.3-55.amzn2023.src
x86_64:
jpegxl-debuginfo-0.10.3-55.amzn2023.x86_64
libjxl-devtools-debuginfo-0.10.3-55.amzn2023.x86_64
libjxl-debuginfo-0.10.3-55.amzn2023.x86_64
libjxl-devel-0.10.3-55.amzn2023.x86_64
jxl-pixbuf-loader-debuginfo-0.10.3-55.amzn2023.x86_64
libjxl-utils-debuginfo-0.10.3-55.amzn2023.x86_64
jxl-pixbuf-loader-0.10.3-55.amzn2023.x86_64
libjxl-utils-0.10.3-55.amzn2023.x86_64
libjxl-0.10.3-55.amzn2023.x86_64
libjxl-devtools-0.10.3-55.amzn2023.x86_64
jpegxl-debugsource-0.10.3-55.amzn2023.x86_64