CVE-2025-12474: 
NixOS vulnerability analysis and mitigation

CVE-2025-12474 is an uninitialized memory read vulnerability in the libjxl JPEG XL decoder library, caused by an incorrect optimization in patch handling. A specially-crafted JPEG XL file can cause the decoder to reference an outside-image-bound area in subsequent patches, leading the decoder to omit populating those memory regions and subsequently read pixel data from uninitialized (but allocated) memory. The vulnerability affects libjxl versions 0.7.0 through 0.11.1 and was published on February 11, 2026. It carries a CVSS v3.1 base score of 4.4 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-908 (Use of Uninitialized Resource) and CWE-125 (Out-of-bounds Read). An incorrect optimization in the low-memory rendering pipeline causes the decoder to skip populating memory areas that fall outside image bounds when processing patch references; when those areas are subsequently read for pixel data, the decoder accesses uninitialized (but allocated) heap memory. Exploitation requires a user to open a specially-crafted JXL image file, making the attack vector local with required user interaction. The fix, merged on October 29, 2025 in GitHub pull request #4495, consolidates the x0/xsize calculations for ProcessRow in low_memory_render_pipeline.cc to ensure all referenced areas are properly populated before being read (libjxl PR #4495, Red Hat Bugzilla).

Successful exploitation results in limited information disclosure, as the decoder may expose contents of uninitialized heap memory regions to an attacker who controls the crafted image and can observe the decoded output. There is also a low integrity impact, as the decoded pixel data may be incorrect due to the uninitialized reads. Availability is not impacted. The scope is limited to the process decoding the malicious file, with no direct path to lateral movement or privilege escalation (Red Hat Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is 0.01% (0.000100), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (opening a malicious file) and the ability to observe decoded output, further limiting practical exploitability (Red Hat Advisory).

The fix was merged into the libjxl main branch via pull request #4495 on October 29, 2025, and users should upgrade to a version of libjxl that includes this patch (post-0.11.1). Downstream distributions including Amazon Linux 2, SUSE, openSUSE, and Fedora have issued updated packages addressing this CVE. As an interim workaround, avoid processing JPEG XL image files from untrusted sources using affected libjxl versions. Given the low severity (CVSS 4.4 / 2.3), patching can be scheduled as part of routine maintenance rather than treated as an emergency (libjxl PR #4495, Red Hat Advisory).

Coverage has been limited to routine vulnerability tracking by security databases and Linux distribution security teams, including Red Hat, SUSE, Amazon Linux, and Fedora. No notable researcher commentary or significant community discussion has been identified beyond standard advisory publications.