{"id":"GHSA-66m8-c62j-h6v5","title":"jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow","summary":"jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow","severity":"medium","cvss":6.2,"cwe":["CWE-131","CWE-190"],"vendor":"jxl-oxide","product":"jxl-oxide","ecosystem":"rust","affected":["jxl-oxide <= 0.12.5"],"patched":["jxl-oxide 0.12.6"],"published":"2026-07-02","updated":"2026-07-02","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-66m8-c62j-h6v5","references":[{"url":"https://github.com/tirr-c/jxl-oxide/security/advisories/GHSA-66m8-c62j-h6v5"},{"url":"https://github.com/advisories/GHSA-66m8-c62j-h6v5"}],"tags":["ghsa","rust"],"ingestedAt":"2026-07-02T21:44:45.100Z","slug":"GHSA-66m8-c62j-h6v5","body":"## Overview\n\n### Summary\n`jxl-oxide` exposes a public safe API that can construct an undersized `FrameBuffer` due to unchecked `usize` multiplication, which immediately trigger panic while initializing the buffer in normal decoding path.\n\nAdditionally, calling the safe grouped buffer accessors afterward can create invalid oversized slices from a much smaller allocation, causing undefined behavior; however normal decoding path never reaches UB, because these methods are never used within `jxl-oxide`.\n\n### Impact\nOn 32-bit platforms this can cause panic by accessing out-of-range indices, making it a DoS vulnerability.\n\n## Affected packages\n\n- `jxl-oxide <= 0.12.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jxl-oxide 0.12.6`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}