A heap buffer overflow exists in libjxl 0.12.0 and is triggered by a crafted PBM image processed by the DecodeImagePNM function. The flaw leads to corrupt memory, potentially allowing arbitrary code execution or denial of service. The vulnerability is based on CWE-122 Heap-based Buffer Overflow, meaning the attacker can overwrite adjacent memory.

The bug is present in libjxl version 0.12.0, which is used wherever JPEG‑XL images are decoded, especially when the application supports PBM inputs. Any software that integrates this library and processes untrusted PBM files could be affected.

The CVSS score of 7.3 indicates a high severity. EPSS is not available and the vulnerability is not listed in CISA KEV. The attack vector is inferred to require the ability to supply a crafted PBM file to the vulnerable application, after which the buffer overflow may be exploited to execute arbitrary code. There is no public evidence of active exploitation at this time.