The vulnerability in libjxl 0.9 involves improper memory handling during color transformation of grayscale images when the LCMS2 CMS engine is used. Specifically, the decoder writes pixel data to uninitialized and unallocated memory regions because buffers allocated for 1-float-per-pixel are treated as if they were for 3-float-per-pixel. This memory corruption issue is classified under CWE-805 (buffer access with incorrect length value) and CWE-787 (out-of-bounds write). The issue does not affect builds using the alternative CMS engine. No patch information is provided in the advisory, and no known exploits are reported in the wild.

Successful exploitation can lead to memory corruption, potentially causing application crashes or allowing an attacker to influence program behavior by manipulating pixel data in memory. The CVSS 4.0 score of 8.7 indicates high severity with network attack vector, no privileges required, and user interaction needed. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory URL is provided but does not explicitly mention a fix. Users should monitor the vendor advisory for updates. As a temporary mitigation, avoid processing grayscale images with color transformation using the LCMS2 CMS engine in libjxl 0.9. Alternatively, build libjxl with the other CMS engine if feasible.