tirr-c jxl-oxide/jxl-grid Grid Arithmetic blend.rs with_alloc_tracker out-of-bounds write

Summaryinfo

A vulnerability marked as critical has been reported in tirr-c jxl-oxide and jxl-grid. This affects the function AlignedGrid::with_alloc_tracker of the file crates/jxl-render/src/blend.rs of the component Grid Arithmetic. Performing a manipulation results in out-of-bounds write. This vulnerability is cataloged as CVE-2026-52834. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in tirr-c jxl-oxide and jxl-grid (the affected version is unknown). This affects the function AlignedGrid::with_alloc_tracker of the file crates/jxl-render/src/blend.rs of the component Grid Arithmetic. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::with_alloc_tracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area limit while overflowing the usize element count, causing modular, VarDCT, or filter rendering paths to allocate a backing buffer smaller than the logical grid. A tiny bitstream-controlled cropped frame combined with a huge canvas or requested region can also reach the vulnerable composition path in crates/jxl-render/src/blend.rs through ordinary render_frame(). Later mutable subgrid and raw-pointer operations can then perform attacker-controlled out-of-bounds writes, causing memory corruption, denial of service, or arbitrary code execution. This issue is fixed in jxl-grid version 0.6.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-52834 since 06/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/19/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• tirr-c

Name

• jxl-grid
• jxl-oxide

Website

• Product: https://github.com/tirr-c/jxl-oxide/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion