A specially-crafted file can cause libjxls decoder to read pixel data from uninitialized (but allocated) memory.
This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas.
Weakness
The product uses or accesses a resource that has not been initialized.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libjxl | Libjxl_project | 0.7.0 (including) | 0.11.1 (including) |
| Graphicsmagick | Ubuntu | esm-apps/xenial | * |