The vulnerability arises from integer overflow during grid size calculations in the jxl‑grid library when decoding JPEG XL images on 32‑bit platforms. Prior to jxl‑grid 0.6.2, a crafted image with a 65536 × 65536 frame can exceed the frame‑area limit while overflowing the usize element count, causing the rendering engine to allocate a backing buffer smaller than the logical grid. Furthermore, a bitstream‑controlled cropped frame combined with a massive canvas or requested region can trigger a vulnerable composition path in jxl‑render’s blend module during ordinary render_frame execution. Subsequent mutable subgrid and raw‑pointer operations then perform attacker‑controlled out‑of‑bounds writes, leading to memory corruption, denial of service, or potential arbitrary code execution.

Affected products are tirr-c:jxl-grid and tirr-c:jxl-oxide. The flaw exists in all releases prior to jxl-grid 0.6.2 and propagates to jxl‑oxide until that revision of its dependency. The issue only manifests on 32‑bit platforms, and any system running a buggy version of the decoder while processing untrusted JPEG XL images is vulnerable.

The vulnerability carries a CVSS score of 7.3, indicating high severity. Its EPSS score is less than 1 %, showing a low but non‑zero probability of exploitation. It is not listed in the CISA KEV catalog, implying no known large‑scale attacks to date. Attackers would need to supply a malicious JPEG XL file that is parsed by a local, 32‑bit instance of jxl‑oxide. The exploit requires precise image dimensions and a 32‑bit platform, making the attack vector moderately complex. Remote exploitation could be possible only if the decoder is exposed through a network service or within an application that accepts untrusted images, but the primary threat remains local or user‑initiated decoding.