The vulnerability is an integer underflow in the container box parser of libjxl before version 0.12.0, causing a 32‑bit truncation of 64‑bit box sizes to size_t on 32‑bit platforms. This flaw can make the decoder interpret attacker‑controlled bytes as phantom box headers, allowing the injection of arbitrary metadata such as Exif, XMP, IPTC, or JUMBF, and potentially leading to out‑of‑bounds reads.

All releases of libjxl prior to 0.12.0 are impacted. Any software that incorporates libjxl to decode JPEG XL images—such as image editors, browsers, or server‑side rendering services—must be evaluated for use of the vulnerable library version.

The CVSS score of 5.3 indicates moderate severity and the EPSS score is not available, implying no recent exploitation data. The vulnerability is not listed in CISA KEV. Attackers can exploit it remotely by supplying a crafted JPEG XL file; the parser will misinterpret the metadata boxes, enabling injection or potential memory corruption. The risk is primarily data integrity and possible memory safety violations rather than remote code execution.