In nsJXLDecoder::AllocateFrameBuffers, when the decoded image uses PixelFormat::Cmyk8, the K-channel buffer was sized by evaluating size.width * size.height and passing the result to mKBuffer.resize. Because size.width and size.height are narrow (32-bit) integer types, their product is computed in 32-bit arithmetic and can wrap around for attacker-controlled large dimensions, so resize allocates a buffer far smaller than width * height bytes. The invariant that the K-channel buffer must hold one byte per pixel was thus violated, setting up a subsequent heap buffer overflow when the full-resolution K channel is decoded into the undersized allocation.

The fix casts one operand to size_t (size_t(size.width) * size.height), forcing the multiplication into 64-bit (pointer-width) arithmetic so the product no longer overflows and resize receives the true pixel count.

An attacker who gets a victim to load a crafted JXL image achieves a heap buffer overflow in the image-decoding path, which runs in the content/renderer process. The only precondition is that the target processes the malicious image; the CVE metadata rates the impact moderate/medium with no exploit primitive claimed beyond the memory-safety defect.