A specially crafted JXL image can trigger an out‑of‑bounds write in libjxl’s decoder when the library requests a grayscale color transformation via the LCMS2 color management engine. The decoder incorrectly treats buffers sized for one float per pixel as if they hold three floats, writing past the allocated memory and then copying data from another uninitialised region into the pixel data. This corrupts memory and can cause crashes or provide an attacker with the ability to influence processor state if additional exploitation conditions are met.

Affecting Google's libjxl library, particularly builds that use the LCMS2 engine as the CMS component. No specific affected versions are listed; any release compiled with the default LCMS2 engine may be vulnerable. Versions compiled with an alternative CMS engine are not impacted.

The vulnerability carries a CVSS score of 8.7, indicating high severity. Its EPSS score is below 1%, implying a low probability of widespread exploitation, and it is not listed in the CISA KEV catalog. Exploitation requires feeding a malicious JXL file to a system using libjxl with LCMS2; the likely attack vector is local or file‑based, though if the library processes network data, remote exploitation becomes possible. The memory corruption could lead to a crash or, if the attacker controls the uninitialised memory, arbitrary code execution.