Live › vulnerability › CVE-2026-91189
Go to dashboardThe GUIX binary resource loader reads a font page's first and last glyph values without checking that the range is valid. A crafted file with first_glyph greater than last_glyph makes the buffer size calculation wrap, so the loader writes attacker-chosen glyph data past a too-small buffer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Firmware and embedded UI products built on Eclipse ThreadX GUIX that load GUIX Studio binary resources (themes or fonts) from removable media, updates or other input they did not produce. The wrap needs GX_EXTENDED_UNICODE_SUPPORT (e.g. CJK or emoji fonts) and is exploitable on 32-bit targets; the advisory says 64-bit builds have the bug but are not exploitable by this route. Products that only use resources compiled in at build time, or build with GX_DISABLE_BINARY_RESOURCE_SUPPORT, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| GUIX (Eclipse ThreadX) | vendor | <= 6.5.1.202602a | 6.5.2.202603 |
6.5.1.202602a is affected6.5.2.202603 (rejects first_glyph > last_glyph, checks reservation multiplies)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GUIX binary resource loader never checks that a font page's glyph range is well formed. gx_page_header_first_glyph and gx_page_header_last_glyph are read verbatim from the file and only the upper bound of last_glyph is validated, so a page declaring first_glyph > last_glyph makes last - first + 1 underflow to a very large unsigned count.
That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
This page as .md · .json · in your agent: get_signal("CVE-2026-91189")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.