CVE-2025-70103

Publication date 29 May 2026

Last updated 2 June 2026

Ubuntu priority

Why this priority?

Cvss 3 Severity Score

Score breakdown

Description

Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
jpeg-xl	26.04 LTS resolute	Needs evaluation
	25.10 questing	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
jpeg-xl	Upstream: 49fb89f

Severity score breakdown

Parameter	Value
Base score	7.3 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

Other references

Access our resources on patching vulnerabilities