USN-8582-1: jbig2dec vulnerabilities

unknownCVE-2023-46361 CVE-2026-38076

Zeng Yunxiang and Song Jiaxuan discovered that jbig2dec had an out-of-bounds read vulnerability in its command-line tool. An attacker could possibly use this issue to cause jbig2dec to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-46361) It was discovered that jbig2dec had an integer overflow in the jbig2_arith_iaid_ctx_new() function. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-38076)

CSIRTS triage

vendor: null product: jbig2dec Denial of serviceaffected: Ubuntu 22.04 LTS

What: There is an out-of-bounds read vulnerability that can cause jbig2dec to crash.
Who is affected: Users of jbig2dec on Ubuntu 22.04 LTS.
Urgency: Remediation is necessary to prevent denial of service due to the identified vulnerabilities.
Action: Update jbig2dec to the latest version to mitigate the vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch jbig2dec

Get an email when a new jbig2dec advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-21
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8582-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2023-463610.75% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 51% of all scored CVEs.
Low exploitation riskCVE-2026-380760.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 35% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2023-46361	coverage & exploitation status	NVD · CVE.org
CVE-2026-38076	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highCVE-2026-38076: An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows…nvd