{"id":"CVE-2026-91059","kind":"vulnerability","aliases":["CVE-2026-91059"],"related":[],"title":"GUIX JPEG decoder: out-of-order markers let a file overread memory","description":"The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it.\n\n\n\nAny consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path.\n\n\n\nReproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.","summary":"The GUIX JPEG software decoder accepts a second SOF0 frame header after SOS, re-running the parser after the output buffer is sized. The decoder then reports pixel dimensions larger than the real allocation, so consumers such as GUIX display drivers read past the buffer.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["display-firmware","embedded","guix","package","rtos"],"not_affected_if":["no-jpeg-decoding","software-decoder-disabled"],"how_to_check":"- Check whether the device firmware or application builds GUIX with `GX_SOFTWARE_DECODER_SUPPORT` enabled (enabled by default)\n- Check the GUIX version in use against the affected range; unknown if the sources do not list it","fix":"- Update GUIX to a release that enforces JPEG marker ordering; the fixed version is unknown from the sources\n- Until patched, unknown; the sources do not name a workaround","status":"open","published_at":"2026-10-20T15:17:35+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:44:48+00:00","updated_at":"2026-10-25T03:44:48+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:44:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update GUIX to a release that enforces JPEG marker ordering; the fixed version is unknown from the sources\n- Until patched, unknown; the sources do not name a workaround","reach":"unknown","title":"GUIX JPEG decoder: out-of-order markers let a file overread memory","impact":"low","summary":"The GUIX JPEG software decoder accepts a second SOF0 frame header after SOS, re-running the parser after the output buffer is sized. The decoder then reports pixel dimensions larger than the real allocation, so consumers such as GUIX display drivers read past the buffer.","category":"package","nicknames":[],"who_cares":["guix","embedded","rtos","display-firmware"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Out-of-bounds memory read when drawing a crafted JPEG image","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-91059) and GUIX vendor advisories for the affected versions, the fixed release, and whether the flaw is an out-of-bounds read only or can also write memory.","how_to_check":"- Check whether the device firmware or application builds GUIX with `GX_SOFTWARE_DECODER_SUPPORT` enabled (enabled by default)\n- Check the GUIX version in use against the affected range; unknown if the sources do not list it","needs_analyst":true,"not_affected_if":["no-jpeg-decoding","software-decoder-disabled"],"who_is_affected":"Applications that decode JPEG images with GUIX's built-in software decoder and pass the result to the draw path, typically embedded or RTOS devices with displays. Systems that never decode untrusted JPEG files, or that disable the software decoder, are likely not exposed. Whether a firmware image in the field includes the affected code is unknown.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":3439,"output_tokens":676,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91059':16A,19A 'accept':32B 'alloc':61B,109C,132C 'alreadi':107C 'behind':133C 'bound':145C 'buffer':48B,72B,105C 'configur':163C 'consum':63B,136C 'cve':14A,17A 'data':128C 'decod':3A,31B,52B,77C,115C,166C 'default':162C,171C 'dimens':56B,126C 'display':21B,67B,150C 'display-firmwar':20B 'draw':156C 'driver':68B,151C 'embed':23B 'enabl':169C 'enforc':78C 'exceed':130C 'file':11A,85C 'firmwar':22B 'frame':36B,91C,99C 'geometri':112C 'guix':1A,24B,28B,66B,74C,147C 'gx':117C,122C,164C 'header':37B,92C,100C 'includ':146C 'jpeg':2A,29B,75C,82C 'larger':57B 'latch':113C 'let':9A 'marker':8A,83C 'memori':13A 'order':7A,80C 'ordinari':155C 'out-of-ord':4A 'output':47B,104C 'overread':12A 'packag':25B 'parser':44B,101C 'past':70B 'path':157C 'pixel':55B 'pixelmap':123C 'place':87C 'publish':120C 're':41B,96C 're-run':40B,95C 'reach':152C 'read':69B,142C 'real':60B 'report':54B,125C 'reproduc':158C 'return':116C,140C 'rtos':26B 'run':42B,97C 'second':34B,89C 'ship':161C 'size':50B,129C 'sof0':35B,90C 'softwar':30B,76C,165C 'sos':39B,94C 'structur':141C 'success':118C 'support':167C 'trust':138C 'whose':124C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode JPEG images with GUIX's built-in software decoder and pass the result to the draw path, typically embedded or RTOS devices with displays. Systems that never decode untrusted JPEG files, or that disable the software decoder, are likely not exposed. Whether a firmware image in the field includes the affected code is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91059","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91059","severity":null,"published_at":"2026-10-20T15:17:35+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}