---
id: GHSA-66m8-c62j-h6v5
title: 'jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow'
summary: 'jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow'
severity: medium
cvss: 6.2
cwe:
  - CWE-131
  - CWE-190
vendor: jxl-oxide
product: jxl-oxide
ecosystem: rust
affected:
  - jxl-oxide <= 0.12.5
patched:
  - jxl-oxide 0.12.6
published: '2026-07-02'
updated: '2026-07-02'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-66m8-c62j-h6v5'
references:
  - url: >-
      https://github.com/tirr-c/jxl-oxide/security/advisories/GHSA-66m8-c62j-h6v5
  - url: 'https://github.com/advisories/GHSA-66m8-c62j-h6v5'
tags:
  - ghsa
  - rust
ingestedAt: '2026-07-02T21:44:45.100Z'
---

## Overview

### Summary
`jxl-oxide` exposes a public safe API that can construct an undersized `FrameBuffer` due to unchecked `usize` multiplication, which immediately trigger panic while initializing the buffer in normal decoding path.

Additionally, calling the safe grouped buffer accessors afterward can create invalid oversized slices from a much smaller allocation, causing undefined behavior; however normal decoding path never reaches UB, because these methods are never used within `jxl-oxide`.

### Impact
On 32-bit platforms this can cause panic by accessing out-of-range indices, making it a DoS vulnerability.

## Affected packages

- `jxl-oxide <= 0.12.5`

## Remediation

Upgrade to a patched release:

- `jxl-oxide 0.12.6`