GHSA-2v8p-fqpx-2q3w jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)
Crafted JXL images cause a panic in jxl-oxide when overflow checks are enabled, leading to denial of service in applications processing untrusted images.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2v8p-fqpx-2q3w?
GHSA-2v8p-fqpx-2q3w is a vulnerability in jxl-modular, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
Logic bug in decode_simple_table_slow may cause integer arithmetic overflow when decoding Modular image with certain kind of MA tree, which may panic with overflow-checks enabled.
Impact
Denial of service: any application passing untrusted JXL data to JxlImage::render_frame (or equivalent) can be
crashed. Affects all builds with overflow checks enabled, which includes debug builds and any release build
that sets overflow-checks = true in Cargo.toml or [profile.*].
No memory corruption is possible — the panic fires before any unsafe code is reached.
Which versions are affected by GHSA-2v8p-fqpx-2q3w?
2 open source packages ship an affected version, including jxl-modular.
| Package | Affected | Fixed in |
|---|---|---|
jxl-modular crates.io | All versions | 0.11.3 |
jxl-modular crates.io | All versions | 0.11.3 |
How do I fix GHSA-2v8p-fqpx-2q3w?
Upgrade jxl-modular to 0.11.3 or later.
Is GHSA-2v8p-fqpx-2q3w being exploited?
There is no known exploitation of GHSA-2v8p-fqpx-2q3w in the wild and no public exploit code.