CVE-2026-52834
Received Received - Intake

Heap Overflow in jxl-oxide JPEG XL Decoder

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::with_alloc_tracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area limit while overflowing the usize element count, causing modular, VarDCT, or filter rendering paths to allocate a backing buffer smaller than the logical grid. A tiny bitstream-controlled cropped frame combined with a huge canvas or requested region can also reach the vulnerable composition path in crates/jxl-render/src/blend.rs through ordinary render_frame(). Later mutable subgrid and raw-pointer operations can then perform attacker-controlled out-of-bounds writes, causing memory corruption, denial of service, or arbitrary code execution. This issue is fixed in jxl-grid version 0.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-52834
EUVD
EUVD-2026-62513

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
jxl-grid jxl-grid 0.6.2
tirr-c jxl-grid to 0.6.2 (exc)
tirr-c jxl-grid 0.6.2
tirr-c jxl-oxide 0.12.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow issue in the jxl-oxide library affecting 32-bit platforms. It occurs when decoding crafted JPEG XL images, causing length calculations to overflow. This leads to allocation of undersized buffers, resulting in out-of-bounds writes during rendering. The flaw can be triggered by huge frames or cropped frames with large canvas sizes.

Detection Guidance

Detecting this vulnerability requires checking the version of jxl-grid in use. Run `cargo tree -p jxl-grid` in Rust projects to verify if the version is below 0.6.2. Additionally, scan for suspicious image processing activities or crashes when decoding JPEG XL files.

Impact Analysis

This vulnerability can lead to memory corruption, denial of service, or arbitrary code execution when a user decodes a malicious JPEG XL image. It specifically affects 32-bit systems and can be exploited through normal image decoding paths like render_frame().

Compliance Impact

This vulnerability primarily affects software security and memory safety rather than directly impacting compliance with standards like GDPR or HIPAA. However, if exploited, it could lead to unauthorized code execution or data corruption, which may indirectly violate data protection requirements under GDPR (e.g., integrity and confidentiality of personal data) or HIPAA (e.g., integrity of protected health information).

Mitigation Strategies

Immediately upgrade jxl-grid to version 0.6.2 or later. For Rust projects, update the dependency in Cargo.toml to `jxl-grid = ">=0.6.2"`. Avoid processing untrusted JPEG XL images until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52834. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart