CVE-2026-52834

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

EUVD-2026-62513

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834 jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834

The Rust crate jxl-grid (versions 0.1.1–0.5.3) computes width * height unchecked in AlignedGrid::with_alloc_tracker, which overflows usize on 32-bit targets, allocating undersized backing buffers. A crafted JPEG XL image decoded via render_frame() triggers out-of-bounds writes through mutable sub...

CVE-2026-52834

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

CVE-2026-52834: Heap-based Buffer Overflow

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::withalloctracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area lim...

PT-2026-80597

These are all security issues fixed in the markdown-oxide-0.25.12-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11549-1 markdown-oxide-0.25.12-1.1 on GA media

These are all security issues fixed in the markdown-oxide-0.25.12-1.1 package on the GA media of openSUSE Tumbleweed...

Malicious Package

Overview @tailwind-core/oxide-win32-x64-msvc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview @tailwind-core/oxide-linux-x64-gnu is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in @tailwind-core/oxide-linux-x64-gnu (npm)

Source: amazon-inspector a107a0746f2f5159d661e4d332eac53f871b9d22f80caf5863bdd713e252ae00 The package name '@tailwind-core/oxide-linux-x64-gnu' impersonates the legitimate Tailwind CSS v4 oxide engine package '@tailwindcss/oxide-linux-x64-gnu' published under the tailwindlabs scope. Version 4.3.0...

Malicious code in @tailwind-core/oxide-win32-x64-msvc (npm)

Source: amazon-inspector d93cb69a6f12f5739ab03d78641f2a79179750b6182f65ba5b8fb8ec4a1399bc The package name @tailwind-core/oxide-win32-x64-msvc impersonates the legitimate Tailwind CSS scope @tailwindcss published by tailwindlabs. The README claims this is the win32-x64-msvc binary for Tailwind v4...

openSUSE 16 Security Update : go-sendxmpp (openSUSE-SU-2026:21277-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21277-1 advisory. Changes in go-sendxmpp: - Update to 0.16.0: Added: Add Ox support to http-upload. Add Ox support for private group chats. Show error cause if...

dicom-transfer-syntax-registry (>=0.8.2, <=0.9.1), zune-image (>=0.4.0, <=0.5.0-rc0) potentially affected by unknown CVE via jxl-oxide (>=0.4.0, <=0.10.2)

jxl-oxide CARGO version =0.4.0, =0.8.2, =0.4.0, =0.5.0-rc0 Source cves: unknown CVE Source advisory: GHSA-66M8-C62J-H6V5...

GHSA-66M8-C62J-H6V5 jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow

Summary jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path. Additionally, calling the safe grouped buffer accessors afterward can create inval...

dicom-transfer-syntax-registry (>=0.8.2, <=0.9.1), zune-image (>=0.4.0, <=0.5.0-rc0) potentially affected by unknown CVE via jxl-oxide (>=0.4.0, <=0.10.2)

jxl-oxide CARGO version =0.4.0, =0.8.2, =0.4.0, =0.5.0-rc0 Source cves: unknown CVE Source advisory: OSV:GHSA-66M8-C62J-H6V5...

PT-2026-57592

Summary jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path. Additionally, calling the safe grouped buffer accessors afterward can create inval...