Eclipse Foundation Eclipse ThreadX - GUIX vulnerabilities

Latest Eclipse Foundation Eclipse ThreadX - GUIX CVEs

Newest publication first

1. CVE-2026-91057 Out-of-bounds read when a multi-line text view string ends with a carriage return

   Published 2026-10-20

   Medium·CVSS 4.6 EPSS 0.16%

   _gx_multi_line_text_view_display_info_get() reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (\r). The over-read can also cause callers to advance their index past the end of the string, producing a second over-r...

2. CVE-2026-92454 JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode

   Published 2026-10-20

   Medium·CVSS 6.8 EPSS 0.15%

   The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loo...

3. CVE-2026-91059 JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size

   Published 2026-10-20

   Medium·CVSS 6.8 EPSS 0.16%

   The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GX_SUCCESS and publishes a...

4. CVE-2026-91189 GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme

   Published 2026-10-20

   High·CVSS 7.1 EPSS 0.14%

   The GUIX binary resource loader never checks that a font page's glyph range is well formed. gx_page_header_first_glyph and gx_page_header_last_glyph are read verbatim from the file and only the upper bound of last_glyph is validated, so a page declaring first_glyph > last_glyph m...

5. CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader

   Published 2026-10-20

   Medium·CVSS 6.8 EPSS 0.16%

   gx_binres_theme_load() and gx_binres_font_load() take the resource as a bare GX_UBYTE * with no length, and GX_BINRES_DATA_INFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know....

6. CVE-2026-92449 Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena

   Published 2026-10-20

   Medium·CVSS 6.8 EPSS 0.16%

   _gx_binres_pixelmap_table_load() in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. T...

7. CVE-2026-91186 PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write

   Published 2026-10-20

   High·CVSS 8.4 EPSS 0.16%

   The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.