CVE-2025-12474
Medium · 4.4CVSS
4.4
EPSS
0.1%
Published
Feb 11, 2026
CISA due date
—
The record
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | libjxl | 0 | 0.10.3-150700.4.6.1 |
| openSUSE:Leap 16.0 | libjxl | 0 | 0.11.2-160000.1.1 |
| openSUSE:Tumbleweed | libjxl | 0 | 0.11.2-2.1 |
Related vulnerabilities
- CVE-2026-1837 A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized… Also affects libjxl
- CVE-2024-11403 There exists an out of bounds read/write in LibJXL versions prior to commit… Also affects libjxl
- CVE-2025-70103 Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the… Also affects libjxl
- CVE-2024-11498 There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the… Also affects libjxl
- CVE-2026-112897 Pillow is a Python imaging library. CWE-908
- CVE-2026-109273 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure… CWE-908
- CVE-2026-107676 FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in… CWE-908
- CVE-2026-102635 ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory… CWE-908