Threats affecting pkg:github/libjxl

CVE-2026-82522 is an integer underflow vulnerability in libjxl versions before 0.12.0. It occurs in the container box parser due to 64-bit box size truncation to size_t on 32-bit platforms. This flaw allows remote attackers to inject arbitrary metadata by crafting a malicious JPEG XL file that causes the decoder to misinterpret codestream bytes as phantom box headers. The vulnerability can lead to injection of arbitrary metadata such as Exif, XMP, IPTC, and JUMBF, and may also cause out-of-bounds reads.