GHSA-66m8-c62j-h6v5
jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow
Summary
jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path.
Additionally, calling the safe grouped buffer accessors afterward can create invalid oversized slices from a much smaller allocation, causing undefined behavior; however normal decoding path never reaches UB, because these methods are never used within jxl-oxide.
Impact
On 32-bit platforms this can cause panic by accessing out-of-range indices, making it a DoS vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow
Summary
jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path.
Additionally, calling the safe grouped buffer accessors afterward can create invalid oversized slices from a much smaller allocation, causing undefined behavior; however normal decoding path never reaches UB, because these methods are never used within jxl-oxide.
Impact
On 32-bit platforms this can cause panic by accessing out-of-range indices, making it a DoS vulnerability.
- Record
GHSA-66m8-c62j-h6v5- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-131, CWE-190
- Updated
- 2026-11-02
OSV
jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow
Summary
jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path.
Additionally, calling the safe grouped buffer accessors afterward can create invalid oversized slices from a much smaller allocation, causing undefined behavior; however normal decoding path never reaches UB, because these methods are never used within jxl-oxide.
Impact
On 32-bit platforms this can cause panic by accessing out-of-range indices, making it a DoS vulnerability.
- Record
GHSA-66m8-c62j-h6v5- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-131, CWE-190
- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-66m8-c62j-h6v5 is a medium vulnerability (CVSS 6.2) in jxl-oxide, published July 2, 2026. No source lists public exploit code. Fixed in jxl-oxide 0.12.6.