Quick answers
- Is CVE-2025-70103 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-70103 being exploited in the wild.
- How severe is CVE-2025-70103?
- Informational severity, with a CVSS score of 0, published 27 May 2026.
- Which products and versions are affected?
- JPEG XL Project Libjxl 0.12.0.
- Is there a fix for CVE-2025-70103?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-70103 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2025-70103?
- Check whether you run JPEG XL Project Libjxl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap buffer overflow exists in libjxl 0.12.0 within the jxl::extras::DecodeImagePNM function in lib/extras/dec/pnm.cc. The vulnerability is caused by incorrect size calculations during PNM frame initialization and insufficient bounds checking during pixel data copying. Specifically, the decoder fails to validate buffer sizes before memory copy operations, allowing a memcpy to write beyond the allocated 16-byte buffer (e.g., writing 24 bytes). An attacker can exploit this by providing a malformed PBM image, potentially leading to a denial of service or arbitrary code execution. A pull request has been submitted to address the issue by adding general buffer size and row boundary checks.
Affected products
- JPEG XL Project libjxl 0.12.0
Timeline
- 2025-07-13: disclosed: Issue reported on GitHub with PoC
- 2025-07-13: other: Pull request submitted to fix the overflow
- 2026-05-27: advisory: CVE published by NVD