CVE-2025-12474: libjxl Use After Free Vulnerability

CVE-2025-12474 Overview

CVE-2025-12474 is an Uninitialized Memory Use vulnerability affecting the libjxl JPEG XL image library's decoder component. A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This occurs when the decoder is manipulated to reference an outside-image-bound area in subsequent patches, where an incorrect optimization causes the decoder to omit populating those areas.

Critical Impact

Attackers can craft malicious JPEG XL files that cause the decoder to read from uninitialized memory regions, potentially leading to information disclosure or unpredictable application behavior.

Affected Products

• libjxl JPEG XL image library (versions prior to the fix in PR #4495)

Discovery Timeline

• 2026-02-11 - CVE CVE-2025-12474 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2025-12474

Vulnerability Analysis

This vulnerability falls under CWE-908 (Use of Uninitialized Resource). The libjxl decoder contains a flaw in its image patch processing logic that can be exploited through specially-crafted JPEG XL files. When the decoder processes certain image patches that reference areas outside the valid image bounds, an incorrect optimization in the code path causes these memory regions to remain uninitialized rather than being properly populated with valid pixel data.

The vulnerability requires network access and user interaction (opening a malicious file), combined with high attack complexity to successfully exploit. The potential impact is limited to low-severity confidentiality and integrity concerns, with no availability impact identified.

Root Cause

The root cause stems from an incorrect optimization in the libjxl decoder's patch processing routine. When processing JPEG XL images with patches that reference outside-image-bound areas, the decoder fails to properly initialize the memory allocated for these regions. The optimization incorrectly assumes all referenced areas will be within valid bounds, causing it to skip the memory initialization step for out-of-bounds references.

Attack Vector

The attack vector is network-based, requiring an attacker to deliver a malicious JPEG XL file to a victim. Exploitation requires:

1. Crafting a specially-designed JPEG XL file with patches referencing outside-image-bound areas
2. Convincing a user to open the malicious file with an application using the vulnerable libjxl library
3. The decoder processes the file and reads from uninitialized memory regions

The vulnerability mechanism exploits the decoder's patch processing logic. When a JPEG XL file contains patches that reference areas beyond the image boundaries, the affected optimization causes the decoder to skip memory initialization for these regions, resulting in reads from uninitialized but allocated memory. For detailed technical information, refer to the GitHub Pull Request #4495.

Detection Methods for CVE-2025-12474

Indicators of Compromise

• Unexpected behavior or crashes in applications processing JPEG XL files using libjxl
• Memory analysis tools detecting reads from uninitialized memory regions during JPEG XL decoding
• Anomalous JPEG XL files with patches referencing outside-image-bound coordinates

Detection Strategies

• Deploy memory sanitizers (AddressSanitizer, MemorySanitizer) in development and testing environments to detect uninitialized memory access
• Monitor application logs for unexpected decoder errors or warnings when processing JPEG XL files
• Implement file validation checks before processing JPEG XL images from untrusted sources

Monitoring Recommendations

• Enable verbose logging for applications using libjxl to capture decoder anomalies
• Monitor for unusual memory access patterns in processes handling JPEG XL files
• Implement runtime memory monitoring for applications processing image files from external sources

How to Mitigate CVE-2025-12474

Immediate Actions Required

• Update libjxl to the patched version that addresses this vulnerability
• Review applications using libjxl and assess exposure to untrusted JPEG XL files
• Consider temporarily disabling JPEG XL support in high-risk environments until patching is complete

Patch Information

The vulnerability has been addressed in the libjxl project. The fix is available in GitHub Pull Request #4495. Organizations should update to the latest version of libjxl that incorporates this fix.

Workarounds

• Validate JPEG XL files from untrusted sources before processing with additional security scanning
• Implement sandboxing for applications that process untrusted JPEG XL files to limit potential impact
• Consider using alternative image formats where JPEG XL support is not critical until patching is completed

To update libjxl to the patched version, follow the standard build process after pulling the latest changes that include the fix from PR #4495. Consult the libjxl project documentation for specific build instructions for your platform.