Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.2
jxl-oxide: FrameBuffer overflow causes panic on 32-bit systems
published 4 months ago
Summary
A bug in the jxl-oxide software can cause a 32-bit system to crash when decoding images. This is not a major security risk, but it can make the system unavailable. To fix the issue, update to the latest version of jxl-oxide.
What to do
- Update tirr-c jxl-oxide to version 0.12.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | tirr-c | jxl-oxide |
<= 0.12.5 Fix: upgrade to 0.12.6
|
Original advisory text
jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow
### Summary
`jxl-oxide` exposes a public safe API that can construct an undersized `FrameBuffer` due to unchecked `usize` multiplication, which immediately trigger panic while initializing the buffer in normal decoding path.
Additionally, calling the safe grouped buffer accessors afterward can create invalid oversized slices from a much smaller allocation, causing undefined behavior; however normal decoding path never reaches UB, because these methods are never used within `jxl-oxide`.
### Impact
On 32-bit platforms this can cause panic by accessing out-of-range indices, making it a DoS vulnerability.
`jxl-oxide` exposes a public safe API that can construct an undersized `FrameBuffer` due to unchecked `usize` multiplication, which immediately trigger panic while initializing the buffer in normal decoding path.
Additionally, calling the safe grouped buffer accessors afterward can create invalid oversized slices from a much smaller allocation, causing undefined behavior; however normal decoding path never reaches UB, because these methods are never used within `jxl-oxide`.
### Impact
On 32-bit platforms this can cause panic by accessing out-of-range indices, making it a DoS vulnerability.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-131Incorrect Calculation of Buffer Size
CWE-190Integer Overflow
Timeline
Published2 Jul 2026
Updated2 Jul 2026
First seen2 Jul 2026
Sources
GHSA-66m8-c62j-h6v5 · GHSA
Track software like this
Free during beta