libjxl Memory Corruption Vulnerability in Decoder

A memory corruption vulnerability has been identified in the libjxl image decoding library. This issue arises because the decoder can be manipulated to read pixel data from uninitialized, yet allocated, memory. The vulnerability is triggered by causing the decoder to access areas outside the bounds of the image in subsequent patches. An incorrect optimization in the decoding process leads to these areas being left uninitialized, creating the potential for exploitation.

Impact

Exploitation of this vulnerability can lead to undefined behavior, including potential information disclosure or memory corruption.

Remediation

Users can update to the latest version of libjxl, where this vulnerability has been addressed, to mitigate this issue.