Answer in brief
CVE-2026-52834 records a High severity (CVSS 7.3) vulnerability in jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms. The current sources do not mark it as known exploited. The current feed maps tirr-c/jxl-grid (generic), tirr-c/jxl-oxide (generic), jxl-grid (rust). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps tirr-c/jxl-grid (generic), tirr-c/jxl-oxide (generic), jxl-grid (rust). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| tirr-c/jxl-gridgeneric | <0.6.2 | 0.6.2 |
| tirr-c/jxl-oxidegeneric | <0.12.6 | 0.12.6 |
| jxl-gridrust | <=0.6.1 | 0.6.2 |
Published upstream
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 2, 2026
jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::with_alloc_tracker and related grid and subgrid arithmetic. A 65536 x 65536 frame can pass the frame-area limit while overflowing the usize element count, causing modular, VarDCT, or filter rendering paths to allocate a backing buffer smaller than the logical grid. A tiny bitstream-controlled cropped frame combined with a huge canvas or requested region can also reach the vulnerable composition path in crates/jxl-render/src/blend.rs through ordinary render_frame(). Later mutable subgrid and raw-pointer operations can then perform attacker-controlled out-of-bounds writes, causing memory corruption, denial of service, or arbitrary code execution. This issue is fixed in jxl-grid version 0.6.2.
Quoted source text, attributed separately from HOL analysis.