CVE-2025-12474 — libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling

CVE-2025-12474

libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling PUBLISHED

Description (CNA)

A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.

Affected (CNA)

Vendor / product	Versions
Google / libjxl	affected 0.7 through 0.11.1

CWE

CWE-908

References

https://github.com/libjxl/libjxl/pull/4495

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.