CVE-2025-12474

A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.

Score

CVSS 3.1 4.4 Medium

Status

Analyzed - cve-coordination@google.com

Published

2026-02-11

Last modified

2026-02-11

Weaknesses

CWE-908

Affected products

• Libjxl (Google)
• Libjxl (Libjxl Project)

References

• https://github.com/libjxl/libjxl/pull/4495