CVE-2025-12474
libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
- Record
CVE-2025-12474- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-908
- Updated
- 2026-11-02
EUVDEUVD-2025-207023
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
- Record
EUVD-2025-207023- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9gvg-fw8p-72fv
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but...
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
- Record
GHSA-9gvg-fw8p-72fv- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
NVD
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
- Record
CVE-2025-12474- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-908
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-12474
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
- Record
ALPINE-CVE-2025-12474- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
OSV
libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
- Record
CVE-2025-12474- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-908
- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2025-12474
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
- Record
DEBIAN-CVE-2025-12474- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-12474
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
- Record
UBUNTU-CVE-2025-12474- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2026-0548 No score
Updated libjxl package fixes security vulnerabilities
Uninitialized memory read in decoder due to incorrect optimization in patch handling. (CVE-2025-12474) Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc. (CVE-2025-70103) Out-of-bounds write in grayscale color transformation when using LCMS2. (CVE-2026-1837) Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function. (CVE-2026-52584)
- Record
MGASA-2026-0548- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10910-1 No score
libjxl-devel-0.11.2-2.1 on GA media
These are all security issues fixed in the libjxl-devel-0.11.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10910-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20385-1 No score
Security update for libjxl
This update for libjxl fixes the following issues:
Update to libjxl 0.11.2:
- CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory (bsc#1258090).
- CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memory (bsc#1258091).
- Record
openSUSE-SU-2026:20385-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0648-1 No score
Security update for libjxl
This update for libjxl fixes the following issues:
- CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory (bsc#1258090).
- CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memory (bsc#1258091).
- Record
SUSE-SU-2026:0648-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20903-1 No score
Security update for libjxl
This update for libjxl fixes the following issues:
Update to libjxl 0.11.2:
- CVE-2025-12474: a specially crafted file can cause the decoder to read pixel data from uninitialized allocated memory (bsc#1258090).
- CVE-2026-1837: a specially crafted file can cause the decoder to write pixel data to uninitialized unallocated memory (bsc#1258091).
- Record
SUSE-SU-2026:20903-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libjxlAlpine:v3.23 |
0.7.0 up to 0.11.2-r0 | 0.11.2-r0 |
jpeg-xlDebian:12 |
All versions, plus listed versions 0.10.3-10.10.3-20.10.3-30.10.3-40.10.3-5 Show 45 moreShow less0.10.4-10.10.4-20.11.1-10.11.1-20.11.1-30.11.1-40.11.1-50.11.1-60.11.2-0.10.11.2-0.1~deb13u10.11.2-0.1~deb13u20.11.2-10.11.2-20.11.2-30.11.2-3~exp10.11.2-40.11.2-50.11.2-5.10.7.0-100.7.0-10+deb12u10.7.0-10.10.7.0-10.20.8.0-10.8.0~git20221120.4167056-10.8.0~git20221123.8bf8deb-10.8.0~git20230102.26a5158-10.8.0~git20230118.bcacd51-10.8.0~git20230125.a67e970-10.8.1-10.8.1-20.8.2-10.8.2-20.8.2-30.8.2-40.9.0~git20230612.38b629f-10.9.0~git20230612.38b629f-20.9.0~git20230612.38b629f-30.9.0~git20230612.38b629f-40.9.0~git20230623.689da0f-10.9.0~git20230623.689da0f-20.9.0~git20230623.689da0f-30.9.0~git20230623.689da0f-40.9.2-10.9.2-100.9.2-2 |
None known |
jpeg-xlDebian:13 |
before 0.11.2-0.1~deb13u1, plus listed versions 0.11.1-40.11.1-50.11.1-6 |
0.11.2-0.1~deb13u1 |
jpeg-xlDebian:14 |
before 0.11.2-0.1, plus listed versions 0.11.1-40.11.1-50.11.1-60.11.2-0.1~deb13u10.11.2-0.1~deb13u2 |
0.11.2-0.1 |
libjxlMageia:10 From an advisory covering 4 CVEs |
before 0.11.2-1.mga10 | 0.11.2-1.mga10 |
libjxlSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 2 CVEs |
before 0.10.3-150700.4.6.1 | 0.10.3-150700.4.6.1 |
libjxlSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 0.11.2-160000.1.1 | 0.11.2-160000.1.1 |
libjxlSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 0.11.2-160000.1.1 | 0.11.2-160000.1.1 |
graphicsmagickUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.3.16-1.1ubuntu21.3.16-1.1ubuntu31.3.18-1ubuntu31.3.18-1ubuntu3.11.3.18-1ubuntu3.1+esm1 Show 7 moreShow less1.3.18-1ubuntu3.1+esm21.3.18-1ubuntu3.1+esm31.3.18-1ubuntu3.1+esm41.3.18-1ubuntu3.1+esm51.3.18-1ubuntu3.1+esm61.3.18-1ubuntu3.1+esm71.3.18-1ubuntu3.1+esm8 |
None known |
graphicsmagickUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.3.21-31.3.23-11.3.23-1build11.3.23-1ubuntu0.11.3.23-1ubuntu0.1+esm1 Show 7 moreShow less1.3.23-1ubuntu0.21.3.23-1ubuntu0.31.3.23-1ubuntu0.41.3.23-1ubuntu0.51.3.23-1ubuntu0.61.3.23-1ubuntu0.6+esm11.3.23-1ubuntu0.6+esm2 |
None known |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
graphicsmagickUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.26-151.3.26-161.3.26-191.3.27-11.3.27-2 Show 7 moreShow less1.3.27-31.3.28-11.3.28-21.3.28-2ubuntu0.11.3.28-2ubuntu0.1+esm11.3.28-2ubuntu0.21.3.28-2ubuntu0.2+esm1 |
None known |
graphicsmagickUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4+really1.3.33+hg16115-11.4+really1.3.33+hg16115-1build11.4+really1.3.33+hg16117-11.4+really1.3.34-11.4+really1.3.34-2 Show 4 moreShow less1.4+really1.3.34+hg16181-11.4+really1.3.35-11.4+really1.3.35-1ubuntu0.1~esm11.4+really1.3.35-1ubuntu0.1 |
None known |
graphicsmagickUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.4+really1.3.36+hg16481-21.4+really1.3.37-11.4+really1.3.37-1build11.4+really1.3.37+hg16662-1ubuntu11.4+really1.3.38-11.4+really1.3.38-1ubuntu0.11.4+really1.3.38-1ubuntu0.1+esm1 |
None known |
graphicsmagickUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.4+really1.3.42-11.4+really1.3.42-1build11.4+really1.3.42-1.1build11.4+really1.3.42-1.1build21.4+really1.3.42-1.1build31.4+really1.3.42-1.1ubuntu0.1~esm1 |
None known |
graphicsmagickUbuntu:25.10 |
All versions, plus listed versions 1.4+really1.3.45+hg17689-11.4+really1.3.45+hg17696-11.4+really1.3.45+hg17696-1build1 |
None known |
graphicsmagickUbuntu:26.10 |
All versions, plus listed versions 1.4+really1.3.46-21.4+really1.3.48-11.4+really1.3.48-1build11.4+really1.3.48-2 |
None known |
graphicsmagickUbuntu:26.04:LTS |
All versions, plus listed versions 1.4+really1.3.45+hg17696-1build11.4+really1.3.46-2 |
None known |
libjxlopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.11.2-2.1 | 0.11.2-2.1 |
libjxlopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 0.11.2-160000.1.1 | 0.11.2-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-12474 is a low vulnerability (CVSS 2.3) in Google Libjxl, published February 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in libjxl 0.11.2-r0.
References
github.com/libjxl/libjxl/pull/4495
nvd.nist.gov/vuln/detail/CVE-2025-12474
security.alpinelinux.org/vuln/CVE-2025-12474
security-tracker.debian.org/tracker/CVE-2025-12474
Show 22 moreShow less
advisories.mageia.org/MGASA-2026-0548.html
bugs.mageia.org/show_bug.cgi?id=35608
lists.fedoraproject.org/archives/list/[email protected]/message/27TWL6UI5V63S5VG5DHCLZLSTE34XF3B
openwall.com/lists/oss-security/2026/05/30/7
lists.opensuse.org/archives/list/[email protected]/message/W3QKIP6MG3FEJI72LMV2M5365WSHW4BC
ubuntu.com/security/notices/USN-8397-1
lists.debian.org/debian-security-announce/2026/msg00253.html
suse.com/support/update/announcement/2026/suse-su-20260648-1
bugzilla.suse.com/1258090
cve.org/CVERecord?id=CVE-2025-12474
Left out here: 7 versions. The JSON record has them.