Is CVE-2026-1837 actively exploited?

No active exploitation of CVE-2026-1837 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-1837 be exploited remotely?

Yes. CVE-2026-1837 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-1837?

CVE-2026-1837 has a CVSS score of 8.7 (HIGH) and an EPSS exploitation probability of 0.02%.

HOME VULNERABILITIESCVE-2026-1837

HIGH

CVE-2026-1837

CWE-805Published: February 11, 2026· Updated: Feb 11, 2026

8.7

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.3th

Official Description

A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data.

This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).

NVD Source

Technical Analysis

CVE-2026-1837 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (P) is needed, which slightly reduces the risk of mass automated attacks.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionP

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X