Executive brief
libjxl is a software library used for encoding and decoding JPEG XL images. A vulnerability in how the library processes certain image formats could allow an attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted image file. This could impact applications that use this library to display or process user-uploaded images.
Technical details
A heap buffer overflow exists in libjxl 0.12.0 within the jxl::extras::DecodeImagePNM function in lib/extras/dec/pnm.cc. The vulnerability is caused by incorrect size calculations during PNM frame initialization and insufficient bounds checking during pixel data copying. Specifically, the decoder fails to validate buffer sizes before memory copy operations, allowing a memcpy to write beyond the allocated 16-byte buffer (e.g., writing 24 bytes). An attacker can exploit this by providing a malformed PBM image, potentially leading to a denial of service or arbitrary code execution. A pull request has been submitted to address the issue by adding general buffer size and row boundary checks.
Affected products
- JPEG XL Project libjxl 0.12.0
Timeline
- 2025-07-13: disclosed: Issue reported on GitHub with PoC
- 2025-07-13: other: Pull request submitted to fix the overflow
- 2026-05-27: advisory: CVE published by NVD