PT-2026-7614 · Libjxl · Libjxl

Published 2026-02-11 · Updated 2026-05-30 · CVE-2025-12474

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions libjxl (affected versions not specified)

Description A crafted file can lead to libjxl's decoder reading pixel data from uninitialized memory. This occurs due to an incorrect optimization that causes the decoder to omit populating certain memory areas, which are then referenced during subsequent patches, resulting in memory corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2025-12474

OPENSUSE-SU-2026:10910-1

OPENSUSE-SU-2026:20385-1

SUSE-SU-2026:0648-1

SUSE-SU-2026:20903-1

Affected Products

Libjxl

References · 20

• https://github.com/libjxl/libjxl/pull/4495 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-12474 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0648-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10910-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12474 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-12474 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20385-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20903-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12474 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12474 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-12474 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-12474 · Vendor Advisory
• https://bugzilla.suse.com/1258090 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20260648-1 · Note
• https://twitter.com/VulmonFeeds/status/2021631520436302150 · Twitter Post