CVE-2025-12474 LOW

CVE-2025-12474: libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handling

Vendor Google
Product libjxl
Weakness CWE-908
Published February 11, 2026
Last update February 11, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.

Key dates

02Disclosure timeline

February 11, 2026 CVE published
February 11, 2026 Record updated