Product:
libjxl
Summary
A specially-crafted file can cause libjxl’s decoder to read pixel data from uninitialized but allocated memory. This occurs when the decoder references an outside-image-bound area in subsequent patches. An incorrect optimization leads to the omission of populating those areas.
Details
| Severity | Base Score | CVE |
|---|---|---|
| LOW | 2.3 | CVE-2025-12474 |
Exploitation
To exploit this vulnerability, an attacker can create a specially-crafted file that triggers the decoder to access uninitialized memory. By manipulating the input file to reference areas outside the intended image bounds, the attacker can cause the decoder to read sensitive data from memory, potentially leading to information disclosure.
Affected Products
- libjxl: A library for JPEG XL image decoding that is affected by the vulnerability allowing uninitialized memory access.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of libjxl, which includes patches addressing this issue. Regularly updating software and monitoring for security advisories can help prevent exploitation of this and similar vulnerabilities.