Live › vulnerability › CVE-2026-91186
Go to dashboardGUIX (Eclipse ThreadX) PNG decoder accepts a second IHDR after IDAT, changing dimensions after the buffer is allocated; the row-unfilter pass then writes past the end of the heap buffer. Reporter confirmed with a 94-byte file; vendor claims no code execution. Affects products on GUIX <= 6.5.1.202602a that decode PNGs they did not produce (removable media, updates, network); decoder is on by default. Builds that disable the software decoder or load only trusted images can skip it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that decode PNG files supplied by users or other untrusted sources with the affected library are exposed, since the decoder is compiled in by default. Systems that only process trusted, locally generated PNGs can skip it. The sources do not name the affected library or versions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| guix | vendor | <= 6.5.1.202602a | 6.5.2.202603 |
6.5.1.202602a is affected6.5.2.202603 (no backport to 6.4.x)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time.
A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one after IDAT rewrites the image width, height, bit depth and pixel depth after the decoded-data buffer has already been allocated and filled from the original values. The pass that reverses the PNG row filters then derives its own extent from the new dimensions and walks the old allocation, moving image bytes past the end of it.
The buffer is allocated by GUIX rather than supplied by the caller, so the application has no way to size it defensively. The decoder is compiled in by default.
This page as .md · .json · in your agent: get_signal("CVE-2026-91186")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.