This vulnerability is a stack‑based buffer overflow in libjxl's DecodeImageAPNG, allowing an attacker with local access to supply a crafted APNG file and cause the function to read or write beyond the fixed‑size buffer. The overflow can leak data from adjacent memory areas, potentially revealing secrets or credentials that happen to be resident in memory at the time of decoding. The flaw is classified as CWE‑120.

Although no CNA product list is published, the issue applies to libjxl versions 0.11.2 and earlier. Any program that statically or dynamically links against this library and processes APNG images is potentially vulnerable. It is inferred that applications such as image viewers, web browsers, or multimedia frameworks that use libjxl to decode animated PNG files could be affected if they load untrusted image data.

The CVSS score of 7.1 places the flaw in the moderate to high severity range. The EPSS score of less than 1 % indicates that real‑world exploitation is considered unlikely at the moment. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the exploitation requires local access to the host to provide a malicious APNG file, so the attack vector is local. If an attacker gains local execution, the data leakage could be valuable, but the risk remains limited to environments where untrusted images are processed locally.