Executive brief
jxl-oxide is a Rust library used for decoding JPEG XL images. A flaw in how the library calculates memory requirements for image frames can lead to application crashes or unpredictable behavior, particularly on 32-bit systems. This could allow a local attacker to cause a denial-of-service by providing specially crafted image data that triggers these memory errors.
Technical details
The jxl-oxide library contains an integer overflow vulnerability in the `FrameBuffer::new` function due to unchecked `usize` multiplication during buffer size calculation. On 32-bit platforms, this overflow can result in the allocation of an undersized buffer. While the normal decoding path typically triggers a panic (Denial of Service) during initialization, the safe grouped buffer accessors can potentially create invalid, oversized slices pointing to out-of-bounds memory, leading to undefined behavior. The vulnerability is reachable via the public safe API and has been addressed in version 0.12.6.
Affected products
- tirr-c jxl-oxide <= 0.12.5
Timeline
- 2026-05-29: disclosed
- 2026-07-02: advisory
- 2026-07-02: patched: Fixed in version 0.12.6