Executive brief
A denial-of-service vulnerability exists in the jxl-oxide library, which is used to decode JPEG XL images. An attacker can provide a specially crafted image file that causes the application to crash when it attempts to process the data. This results in a service outage for any application using this library to render untrusted images, though it does not lead to data theft or memory corruption.
Technical details
A logic bug in the `decode_simple_table_slow` function of the `jxl-modular` crate (part of the `jxl-oxide` project) leads to an integer arithmetic overflow. This occurs when decoding a Modular image containing a specific type of Meta-Adaptive (MA) tree. The vulnerability triggers a panic in Rust builds where `overflow-checks` are enabled (including all debug builds and release builds with the flag explicitly set). The attack is local in nature, requiring the library to process a malicious JXL file. While this causes a crash (DoS), the panic occurs before any unsafe code is reached, preventing memory corruption. The issue is fixed in version 0.11.3.
Affected products
- tirr-c/jxl-oxide jxl-modular <= 0.11.2
Timeline
- 2026-05-29: disclosed: Initial report to maintainer
- 2026-07-02: advisory: GitHub Advisory published
- 2026-07-02: patched: Version 0.11.3 released