This vulnerability is a heap buffer overflow (CWE-122) in the libjxl library version 0.12.0, specifically triggered by crafted PBM images processed by the jxl::extras::DecodeImagePNM function. The flaw allows an attacker to cause memory corruption, potentially leading to a crash or arbitrary code execution. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor remediation details have been published as of now.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by crashing the application processing the crafted PBM images. The impact affects confidentiality, integrity, and availability of the affected system or application using libjxl 0.12.0. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to avoid processing untrusted PBM images with libjxl 0.12.0 or to apply any temporary mitigations provided by the vendor once available.