---
id: "CVE-2026-91059"
kind: "vulnerability"
aliases: ["CVE-2026-91059"]
title: "GUIX JPEG decoder: out-of-order markers let a file overread memory"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["display-firmware", "embedded", "guix", "package", "rtos"]
not_affected_if: ["no-jpeg-decoding", "software-decoder-disabled"]
published_at: "2026-10-20T15:17:35+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:44:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91059", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# GUIX JPEG decoder: out-of-order markers let a file overread memory

The GUIX JPEG software decoder accepts a second SOF0 frame header after SOS, re-running the parser after the output buffer is sized. The decoder then reports pixel dimensions larger than the real allocation, so consumers such as GUIX display drivers read past the buffer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the device firmware or application builds GUIX with `GX_SOFTWARE_DECODER_SUPPORT` enabled (enabled by default)
- Check the GUIX version in use against the affected range; unknown if the sources do not list it

## Fix

- Update GUIX to a release that enforces JPEG marker ordering; the fixed version is unknown from the sources
- Until patched, unknown; the sources do not name a workaround

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91059

## From the sources

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it.



Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path.



Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_