CVE-2025-12474 libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling
A crafted file triggers uninitialized memory reads in libjxl, potentially exposing sensitive data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-12474?
CVE-2025-12474 is a low-severity vulnerability in Google libjxl, published on 11 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
Weakness: CWE-908
Which versions are affected by CVE-2025-12474?
It affects 1 product.
Products include Libjxl Project Libjxl.
How do I fix CVE-2025-12474?
Apply the vendor's patch.
Is CVE-2025-12474 being exploited?
There is no known exploitation of CVE-2025-12474 in the wild and no public exploit code.
Other vulnerabilities in Google libjxl
Sources
Also known as DEBIAN-CVE-2025-12474, GHSA-9gvg-fw8p-72fv, UBUNTU-CVE-2025-12474.