CVE-2025-12474: libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12474?
CVE-2025-12474 is considered a high severity vulnerability due to the potential for sensitive data exposure through uninitialized memory reads.
How do I fix CVE-2025-12474?
To address CVE-2025-12474, update to the patched version of the libjxl library that resolves the issue with decoder optimization.
What impact does CVE-2025-12474 have on software applications?
CVE-2025-12474 can lead to information disclosure, allowing attackers to read memory that may contain sensitive data.
Which versions of libjxl are affected by CVE-2025-12474?
CVE-2025-12474 affects all versions of libjxl prior to the patch that addresses the uninitialized memory read issue.
How can attackers exploit CVE-2025-12474?
Attackers can exploit CVE-2025-12474 by crafting specially-designed files that trigger uninitialized memory reads in the libjxl decoder.