CVE-2025-70103
High · 7.3CVSS
7.3
EPSS
0.4%
Published
May 27, 2026
CISA due date
—
The record
Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | libjxl | 0 | 0.11.2-160000.2.1 |
| openSUSE:Leap 16.0 | libjxl-gtk | 0 | 0.11.2-160000.2.1 |
| openSUSE:Leap 16.0 | mozjs128 | 0 | 128.14.0-160000.3.1 |
| openSUSE:Tumbleweed | libjxl | 0 | 0.11.2-2.1 |
| openSUSE:Tumbleweed | mozjs115 | 0 | 115.15.0-9.1 |
| openSUSE:Tumbleweed | mozjs140 | 0 | 140.10.1-2.1 |
Related vulnerabilities
- CVE-2026-1837 A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized… Also affects libjxl
- CVE-2025-12474 A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized… Also affects libjxl
- CVE-2024-11498 There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the… Also affects libjxl
- CVE-2024-11403 There exists an out of bounds read/write in LibJXL versions prior to commit… Also affects libjxl
- CVE-2026-32776 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter… Also affects mozjs115
- CVE-2026-32777 libexpat before 2.7.5 allows an infinite loop while parsing DTD content. Also affects mozjs115
- CVE-2026-32778 libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on… Also affects mozjs115
- CVE-2025-62813 LZ4 through 1.10.0 allows attackers to cause a denial of service (application crash) or… Also affects mozjs115