Description

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::with_alloc_tracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area limit while overflowing the usize element count, causing modular, VarDCT, or filter rendering paths to allocate a backing buffer smaller than the logical grid. A tiny bitstream-controlled cropped frame combined with a huge canvas or requested region can also reach the vulnerable composition path in crates/jxl-render/src/blend.rs through ordinary render_frame(). Later mutable subgrid and raw-pointer operations can then perform attacker-controlled out-of-bounds writes, causing memory corruption, denial of service, or arbitrary code execution. This issue is fixed in jxl-grid version 0.6.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T15:17:09.810Z",
  "pubdate": "2026-08-19T15:17:09.810Z",
  "executiveSummary": "An integer overflow vulnerability exists in the jxl-grid component of jxl-oxide prior to version 0.6.2, specifically affecting 32-bit platforms.\nThe vulnerability arises during the processing of crafted JPEG XL images where size calculations in AlignedGrid::with_alloc_tracker and associated grid arithmetic overflow the standard usize element count.\nAn attacker can supply a specially crafted image featuring dimensions such as a 65536 x 65536 frame that bypasses initial frame-area limits while inducing an arithmetic overflow.\nThis mismatch results in the allocation of a backing buffer that is substantially smaller than the logical grid dimensions required by the modular, VarDCT, or filter rendering paths.\nSubsequent mutable subgrid and raw-pointer operations, including those triggered via ordinary render_frame calls reaching crates/jxl-render/src/blend.rs, execute attacker-controlled out-of-bounds write operations.\nThe primary impact of successful exploitation includes memory corruption, denial of service through application crashes, and potential arbitrary code execution.\nExploitation requires the processing of an untrusted, maliciously crafted JPEG XL bitstream on a 32-bit target platform, but does not necessitate authentication or specific prior privileges.",
  "technicalDetails": "The root cause of the vulnerability is an integer overflow in length and size calculations occurring within AlignedGrid::with_alloc_tracker and related grid and subgrid arithmetic functions.\nOn 32-bit platforms, the maximum value of a usize type is significantly smaller than on 64-bit platforms, making it susceptible to arithmetic wrap-around when handling large dimension products.\nAn attacker crafts a malicious JPEG XL bitstream defining a massive logical canvas or cropped frame—such as a 65536 x 65536 frame—that satisfies preliminary frame-area bounds checks while causing the underlying element count calculation to overflow the capacity of a 32-bit usize.\nBecause of this overflow, the memory allocation routine reserves a backing buffer whose size is numerically smaller than the logical grid space it is intended to represent.\nDuring the rendering phase, particularly within the modular decoding, VarDCT, or filter rendering paths, the application interacts with subgrids and raw-pointer operations based on the logical dimensions rather than the truncated allocation size.\nFurthermore, a tiny bitstream-controlled cropped frame combined with a huge canvas or requested region can reach the vulnerable composition path located in crates/jxl-render/src/blend.rs during standard execution of render_frame().\nAs mutable subgrid and raw-pointer operations write data into the grid structures, the execution flows past the boundaries of the undersized backing buffer.\nThis results in heap-based out-of-bounds memory writes, corrupting adjacent heap metadata or critical application data structures.\nPost-exploitation impact ranges from deterministic denial of service via memory corruption faults to arbitrary code execution if critical function pointers or execution control data are overwritten by the attacker-controlled payload."
}