AIKIDO-2026-10498

TL;DR

Affected versions of this package are vulnerable to out-of-bounds memory writes in the DWA lossy decoder due to signed integer overflow during pointer construction. The decoder computes per-component block offsets using signed 32-bit arithmetic, where the calculation of numBlocksX * 64 can overflow for large image widths and produce wrapped pointers outside the allocated rowBlock buffer. These corrupted pointers are later used during the DCT reconstruction path, causing writes to invalid memory. An attacker able to supply a crafted DWAA scanline file can trigger the overflow and subsequent out-of-bounds access, leading to crashes or undefined behavior during decoding.