CVE-2025-12474 Details
Description
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
A memory corruption vulnerability has been identified in the libjxl image decoding library. This issue arises because the decoder can be manipulated to read pixel data from uninitialized, yet allocated, memory. The vulnerability is triggered by causing the decoder to access areas outside the bounds of the image in subsequent patches. An incorrect optimization in the decoding process leads to these areas being left uninitialized, creating the potential for exploitation.
Users can update to the latest version of libjxl, where this vulnerability has been addressed, to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/libjxl/libjxl/pull/4495 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libjxl project libjxl | >= 0.7.0, <= 0.11.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Feb 11, 2026 | New CVE Received | [email protected] |