132 matches found
JXL_Infotainment_CVE-2025-63895
JXLInfotainmentCVE-2025-63895 CVE-2025-63895 攻撃名 📂 追加詳細 影響を受ける製品 影響を受けるコンポーネント Bluetooth Classic version 5.0 Bluetooth firmware stack LMP implementation Infotainment Bluetooth service 攻撃ベクトル Bluetoothの到達範囲内にいる攻撃者は、接続確立中に細工されたLMPパケットを送信することでこの問題を悪用し、インフォテインメントシステムにバッファオーバーフロー/サービス拒否を引き起こす可能性があります。...
JXL_Infotainment_CVE-2025-69515
CVE-2025-69515 اسم الهجوم 📂 تفاصيل إضافية المنتج المتأثر المكونات المتأثرة وحدة استقبال GNSS / رقاقة GPS وحدة الملاحة في نظام المعلومات والترفيه إطار خدمات الموقع متجه الهجوم يمكن استهداف وحدة المعلومات والترفيه عن طريق بث إشارات GPS مزيفة باستخدام جهاز SDR. نظرًا لأن مسار إدخال GNSS يفتقر إلى...
CVE-2026-52834
A flaw was found in jxl-grid, a pure Rust implementation of a JPEG XL decoder. On 32-bit platforms, decoding a specially crafted JPEG XL image can lead to an integer overflow in length calculations. This overflow can cause the allocation of a smaller buffer than required, enabling...
CVE-2026-52834
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
EUVD-2026-62513
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...
CVE-2026-52834
The Rust crate jxl-grid (versions 0.1.1–0.5.3) computes width * height unchecked in AlignedGrid::with_alloc_tracker, which overflows usize on 32-bit targets, allocating undersized backing buffers. A crafted JPEG XL image decoded via render_frame() triggers out-of-bounds writes through mutable sub...
dicom-transfer-syntax-registry (>=0.8.2, <=0.9.1), dset (>=0.1.0, <=0.1.2) +10 more potentially affected by CVE-2026-52834 via jxl-grid (>=0.1.1, <=0.5.3)
jxl-grid CARGO version =0.1.1, =0.8.2, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.5.0-rc0 Source cves: CVE-2026-52834 Source advisory: OSV:GHSA-5PMV-RX8R-WMV5...
GHSA-5PMV-RX8R-WMV5 jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow
Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. Details & PoC The test listed below fail under miri with command cargo +nightly miri test --release -p jxl-grid Or you can use Address Sanitizer, which ignores...
jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow
Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. Details & PoC The test listed below fail under miri with command cargo +nightly miri test --release -p jxl-grid Or you can use Address Sanitizer, which ignores...
dicom-transfer-syntax-registry (>=0.8.2, <=0.9.1), dset (>=0.1.0, <=0.1.2) +2 more potentially affected by unknown CVE via jxl-oxide (>=0.4.0, <=0.11.4)
jxl-oxide CARGO version =0.4.0, =0.8.2, =0.1.0, =0.1.1, =0.4.0, =0.5.0-rc0 Source cves: unknown CVE Source advisory: OSV:GHSA-66M8-C62J-H6V5...
GHSA-66M8-C62J-H6V5 jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow
Summary jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path. Additionally, calling the safe grouped buffer accessors afterward can create inval...
dicom-transfer-syntax-registry (>=0.8.2, <=0.9.1), dset (>=0.1.0, <=0.1.2) +7 more potentially affected by unknown CVE via jxl-modular (>=0.1.0, <=0.10.0)
jxl-modular CARGO version =0.1.0, =0.8.2, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0, =0.5.0-rc0 Source cves: unknown CVE Source advisory: OSV:GHSA-2V8P-FQPX-2Q3W...
Linux Distros Unpatched Vulnerability : CVE-2025-71319
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a...
SUSE CVE-2025-71329
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...
Infinite loop
Overview Affected versions of this package are vulnerable to Infinite loop in the extractPartialStreams and corresponding extraction functions for HEIF, JP2, and JXL. An attacker supplying an image whose requested box declares a size of zero can hang the parser indefinitely. Note: This is a bypas...
CVE-2025-71329
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...
EUVD-2025-210106
image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...