CVE-2026-28956-jxl-messages-surface

JPEG XL автоматически декодируется в пути предпросмотра iOS Messages Находка поверхности доставки для CVE-2026-28956 AppleJPEGXL, а также атрибуция по патч-диффу и проверка реальности публичного PoC. TL;DR — Общепринятое мнение и наши собственные предыдущие измерения с EXR заключается в том, что...

JXL_Infotainment_CVE-2025-69515

CVE-2025-69515 Attack Name 📂 Additional Details Afftected product Affected Components GNSS Receiver Module / GPS Chipset Infotainment Navigation Module Location Services Framework Attack Vector The infotainment unit can be targeted by broadcasting spoofed GPS signals using an SDR device. Because...

JXL_Infotainment_CVE-2025-63895

JXLInfotainmentCVE-2025-63895 CVE-2025-63895 Attack Name 📂 Additional Details Afftected product Affected Components Bluetooth Classic version 5.0 Bluetooth firmware stack LMP implementation Infotainment Bluetooth service Attack Vector An attacker within Bluetooth range can exploit this issue by...

CVE-2026-52834

A flaw was found in jxl-grid, a pure Rust implementation of a JPEG XL decoder. On 32-bit platforms, decoding a specially crafted JPEG XL image can lead to an integer overflow in length calculations. This overflow can cause the allocation of a smaller buffer than required, enabling...

CVE-2026-52834

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

EUVD-2026-62513

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834

The Rust crate jxl-grid (versions 0.1.1–0.5.3) computes width * height unchecked in AlignedGrid::with_alloc_tracker, which overflows usize on 32-bit targets, allocating undersized backing buffers. A crafted JPEG XL image decoded via render_frame() triggers out-of-bounds writes through mutable sub...

CVE-2026-52834

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834: Heap-based Buffer Overflow

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

Unity Linux 20.1070e Security Update: GraphicsMagick (UTSA-2026-099451)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099451 advisory. GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call. Tenable has extracted the...

Unity Linux 20.1070e Security Update: GraphicsMagick (UTSA-2026-099497)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099497 advisory. ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits. Tenable has extracted the preceding description block directly from the...

PT-2026-76041

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, the JXL encoder has an heap write overflow when a user specifies that the image should be encoded as 16 bit floats. This issue has been fixed in version 7.1.2-19...

Fedora 43 : python-pillow-jxl-plugin (2026-75b3256794)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-75b3256794 advisory. Update to 1.3.7, and update PyO3 to 0.29, with fixes for RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block...

GHSA-5PMV-RX8R-WMV5 jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. Details & PoC The test listed below fail under miri with command cargo +nightly miri test --release -p jxl-grid Or you can use Address Sanitizer, which ignores...

dicom-transfer-syntax-registry (>=0.8.2, <=0.9.1), dset (>=0.1.0, <=0.1.2) +10 more potentially affected by CVE-2026-52834 via jxl-grid (>=0.1.1, <=0.5.3)

jxl-grid CARGO version =0.1.1, =0.8.2, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.5.0-rc0 Source cves: CVE-2026-52834 Source advisory: OSV:GHSA-5PMV-RX8R-WMV5...

jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. Details & PoC The test listed below fail under miri with command cargo +nightly miri test --release -p jxl-grid Or you can use Address Sanitizer, which ignores...

GHSA-66M8-C62J-H6V5 jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow

Summary jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path. Additionally, calling the safe grouped buffer accessors afterward can create inval...