jxrlib memory bugs on damaged JPEG XR fixed in fork 1.4.4
Original title: jxrlib: memory bugs on damaged JPEG XR files, fixed in mircomir/jxrlib 1.4.4, still in most distributions
A few-hundred-byte damaged file can trigger a heap overflow write, and most distributions still ship unfixed code.
Joachim Rütter reported memory bugs in jxrlib, Microsoft's abandoned JPEG XR library, that a damaged file of a few hundred bytes can trigger, including a heap buffer overflow write. The bugs are fixed in the maintained fork mircomir/jxrlib 1.4.4, released October 9, 2026. He said most distributions still ship older code. He found the issues while fuzzing decoders in his Featherview image viewer.
Unconfirmed: The snippet does not name CVE identifiers or say whether distributions have backported fixes.
- The upstream Microsoft jxrlib project is abandoned.
- All reported bugs are fixed publicly in mircomir/jxrlib 1.4.4.
- The mailing-list post cuts off before listing individual bug line numbers.
Impact: heap buffer overflow write via a damaged JPEG XR file
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft jxrlib | older code still shipped by most distributions | mircomir/jxrlib 1.4.4 |
- 1.Update to mircomir/jxrlib 1.4.4 instead of older distribution packages.
From the original article
Posted by Joachim Rütter on Oct 24 Hello, jxrlib, Microsoft's JPEG XR library (abandoned upstream), has memory bugs that a damaged JPEG XR file of a few hundred bytes triggers, including a heap buffer overflow write. All of them are fixed in public in the maintained fork github. com/mircomir/jxrlib (1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.