Cyber ·
jxrlib: memory faults in damaged JPEG XR files and fix in fork 1.4.4
An oss-sec advisory describes memory faults in the jxrlib library, abandoned upstream, triggered by a damaged JPEG XR file a few hundred bytes long, including a heap buffer write past the end. Fixes are in fork 1.4.4, released on 9 October 2026.
The advisory, published on 24 October 2026 by a researcher on the oss-sec list, concerns jxrlib, a JPEG XR library originally developed by Microsoft and abandoned upstream. According to the text, a damaged JPEG XR file of a few hundred bytes can trigger memory faults, including a write beyond a heap buffer. All the cited faults were publicly fixed in the fork maintained at github.com/mircomir/jxrlib, version 1.4.4, released on 9 October 2026. The author says most distributions still ship older code. The faults were found by fuzzing the decoders of an image viewer. The available text is truncated before the list of line numbers, so this summary cannot detail which exact functions or versions are affected. To verify, consult the original in the oss-sec archive cited by the advisory, compare your installed version with 1.4.4, and check your distribution's changelog.