CVE-2025-12474

2026-02-11 [email protected]

Information Disclosure

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 16:15 nvd

N/A

DescriptionNVD

A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.

This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.

AnalysisAI

A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches.

Technical ContextAI

Classified as CWE-908 (Use of Uninitialized Resource). A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory.

This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.

Affected ProductsAI

A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory

RemediationAI

Monitor vendor advisories for a patch.

CVE-2025-12474 vulnerability details – vuln.today

Back