CVE-2025-12474 — libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outsid…
Published: 2026-02-11 · CVSS: 2.3 · CVSS 4.0
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7