libjxl CVE-2025-70103

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the buffer-size validation from libjxl PR #4338 (https://github.com/libjxl/libjxl/pull/4338), which rejects PNM inputs whose header dimensions exceed the allocated output/extra-channel buffers, and rebuild or update libjxl once a tagged release incorporating it is published (track issue https://github.com/libjxl/libjxl/issues/4337). Until a patched release is consumed, the most direct compensating control is to disable or block the Netpbm/PNM decode path in libjxl-backed pipelines and restrict accepted input to formats you actually need; the trade-off is loss of PBM/PGM/PPM support for legitimate users. Where the decoder cannot be removed, run image decoding in a sandboxed, memory-isolated worker process (seccomp/containerized) with strict resource limits so a heap overrun is contained to a disposable process, accepting the added operational complexity, and validate/limit declared image dimensions at the application layer before handing files to libjxl.