CVE-2026-1837: 
NixOS vulnerability analysis and mitigation

CVE-2026-1837 is an out-of-bounds write vulnerability in the libjxl JPEG XL decoder that allows a specially crafted image file to cause the decoder to write pixel data to uninitialized, unallocated memory. The flaw affects libjxl versions 0.9.0 through 0.11.1 and is triggered specifically when LCMS2 is used as the color management system (CMS) engine during grayscale-to-grayscale color space transformation. Apple products incorporating libjxl (via the AppleJPEG component) are also affected, including iOS, iPadOS, macOS, and visionOS. The vulnerability was first reported on December 26, 2025, publicly disclosed on February 11, 2026, and patched in Apple platforms on May 11, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a buffer access with incorrect length value (CWE-805) leading to an out-of-bounds write (CWE-787), compounded by allocation without limits or throttling (CWE-770). When a JXL image requests color transformation of a grayscale image to another grayscale color space using LCMS2 as the CMS engine, the decoder incorrectly uses buffers allocated for 1-float-per-pixel as if they were allocated for 3-float-per-pixel. This causes pixel data to be written to uninitialized, unallocated memory, and subsequently data from another uninitialized region is copied into pixel data. The vulnerability is network-exploitable with no authentication or privileges required; an attacker simply needs to supply a maliciously crafted JXL file to a vulnerable decoder. A crash reproducer was publicly filed in the libjxl GitHub issue tracker, and the backtrace confirms the fault occurs in jxl::N_AVX2::CmsStage::ProcessRow during decoder teardown (Red Hat Bugzilla, libjxl GitHub Issue).

Successful exploitation causes a denial of service by crashing the libjxl decoder process when it processes a maliciously crafted JXL image file. On Apple platforms, this manifests as unexpected app termination when processing a maliciously crafted image. There is no evidence of confidentiality or integrity impact under the CVSS v3.1 scoring; however, CVSS v4.0 rates the vulnerability as having high confidentiality, integrity, and availability impact on the vulnerable component, suggesting potential for memory corruption beyond a simple crash in certain exploitation scenarios. Any application or service that processes untrusted JXL images using libjxl with LCMS2 is at risk, including image viewers, web browsers, and media processing pipelines (Apple iOS/iPadOS Advisory, Apple macOS Advisory).

A proof-of-concept crash reproducer is publicly available in the libjxl GitHub issue tracker, filed on December 26, 2025, along with a test JXL file (grayscale_linear.jxl) that triggers the crash. There is no evidence of active in-the-wild exploitation as of the time of this report. The vulnerability requires no authentication, no user interaction (per CVSS v3.1), and no special privileges, making it straightforward to trigger remotely against any service that processes JXL images. The EPSS score is 0.019% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (libjxl GitHub Issue, Red Hat Advisory).

1. Craft a malicious JXL file: Create or obtain a grayscale JXL image (e.g., a 256x256 lossy 16-bit grayscale image with linear transfer function) that requests color transformation to another grayscale color space. The public test file grayscale_linear.jxl from the libjxl issue tracker can serve as a starting point.
2. Identify a target: Locate a service or application that processes JXL images using libjxl versions 0.9.0–0.11.1 compiled with LCMS2 as the CMS engine (the default in many distributions).
3. Trigger decoding with CMS: Ensure the target application calls both JxlDecoderSetCms and JxlDecoderSetPreferredColorProfile during decoding, which activates the vulnerable LCMS2 color transformation path.
4. Submit the crafted file: Deliver the malicious JXL file to the target (e.g., via file upload, email attachment, or web request to an image processing endpoint).
5. Achieve denial of service: The decoder writes pixel data to uninitialized unallocated memory during the grayscale color transformation, causing a crash (abort/SIGABRT) in jxl::N_AVX2::CmsStage::ProcessRow, resulting in process termination (libjxl GitHub Issue, Red Hat Bugzilla).

• Logs: Application crash logs or core dumps referencing jxl::N_AVX2::CmsStage::ProcessRow, JxlCmsDestroy, or jxl::ColorSpaceTransform::~ColorSpaceTransform in the stack trace; malloc_printerr or munmap_chunk errors in process logs indicating heap corruption.
• Process: Unexpected termination (SIGABRT) of image-processing applications or services after receiving a JXL file; Valgrind reports of "Invalid write of size 4" in jxl::N_AVX2::CmsStage::ProcessRow.
• File System: Presence of grayscale JXL files (especially with linear transfer function metadata) in upload directories or temporary processing folders that correlate with application crashes.
• Network: Repeated submission of JXL image files to a web service endpoint immediately preceding service crashes or restarts (libjxl GitHub Issue).

The primary remediation is to update libjxl to a version newer than 0.11.1, which contains the fix for this vulnerability. A patch commit is available in the libjxl GitLab repository. For Apple platforms, the vulnerability is addressed in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5, all released May 11, 2026. As a workaround where immediate patching is not possible, rebuild libjxl using an alternative CMS engine (not LCMS2), as the vulnerability only manifests when LCMS2 is selected via build flags. Additionally, restrict or disable processing of untrusted JXL image files in exposed services until patching is complete (Apple iOS/iPadOS Advisory, Apple macOS Advisory, Red Hat Advisory).

Apple acknowledged the vulnerability in its May 11, 2026 security advisories for iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5, noting it as a third-party open source vulnerability affecting the AppleJPEG component with a denial-of-service impact. Red Hat tracked the issue via Bugzilla and assigned it high severity. The Zero Day Initiative published a review of the Apple macOS security update that included this CVE. Linux distributions including SUSE, Ubuntu, Amazon Linux 2, and Fedora have also issued advisories and package updates. Community coverage appeared on security aggregators such as LinuxSecurity.com and pro-linux.de (Apple iOS/iPadOS Advisory, Apple macOS Advisory, Red Hat Advisory).