{"id":"CVE-2026-91189","kind":"vulnerability","aliases":["CVE-2026-91189"],"related":[],"title":"GUIX font loader: malformed glyph range causes heap overflow","description":"The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count.\n\n\n\nThat count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.","summary":"The GUIX binary resource loader reads a font page's first and last glyph values without checking that the range is valid. A crafted file with first_glyph greater than last_glyph makes the buffer size calculation wrap, so the loader writes attacker-chosen glyph data past a too-small buffer.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GUIX (Eclipse ThreadX)","fixed":["6.5.2.202603"],"affected":"<= 6.5.1.202602a","ecosystem":"vendor"}],"ecosystems":[],"tags":["32-bit","eclipse-threadx","embedded","font-loading","guix","mcu","other"],"not_affected_if":["64-bit-build","no-binary-resources","no-extended-unicode","trusted-resources-only"],"how_to_check":"Check your GUIX version (version macros in gx_api.h, or your vendored copy): <= 6.5.1.202602a is affected. Then check for GX_EXTENDED_UNICODE_SUPPORT in your build flags and whether GX_BINARY_RESOURCE_SUPPORT is left enabled (default on) and your code calls gx_binres_theme_load or gx_binres_font_load on files you did not produce.","fix":"Upgrade GUIX to 6.5.2.202603 (rejects first_glyph > last_glyph, checks reservation multiplies). Also move to the _ext loaders that take the resource length; the length-less loaders are deprecated. Workaround until then: load binary resources only from trusted sources, or build with GX_DISABLE_BINARY_RESOURCE_SUPPORT if unused.","status":"open","published_at":"2026-10-20T15:17:36+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:34:39+00:00","updated_at":"2026-10-25T03:36:12+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-25T03:34:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GUIX font loader: malformed glyph range causes heap overflow","impact":"high","summary":"The GUIX binary resource loader reads a font page's first and last glyph values without checking that the range is valid. A crafted file with first_glyph greater than last_glyph makes the buffer size calculation wrap, so the loader writes attacker-chosen glyph data past a too-small buffer.","category":"other","nicknames":[],"who_cares":["guix","embedded","font-loading"],"confidence":0.5,"needs_auth":"unknown","worst_case":"attacker writes memory in the loader, possibly running code","analyst_note":"Check the NVD entry and the GUIX project advisory for the affected versions, the fixed release, and whether the font file is loaded from untrusted input.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000525,"input_tokens":3442,"output_tokens":362,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the GUIX project advisory for the affected versions, the fixed release, and whether the font file is loaded from untrusted input.","search":"'-2026':11A,14A '-91189':12A,15A '1':138C '32':19B 'alloc':175C 'attack':73B,202C 'attacker-chosen':72B 'attacker-control':201C 'binari':32B,85C 'bit':20B 'bound':121C 'buffer':64B,82B,159C,177C,209C 'calcul':66B 'caus':7A 'check':46B,89C 'chosen':74B 'control':203C 'count':145C,147C,194C 'craft':53B 'cve':10A,13A 'data':76B,182C 'declar':130C 'eclips':22B 'eclipse':17A 'eclipse-threadx':21B 'embed':24B 'far':178C 'file':54B,116C 'first':40B,56B,103C,131C,137C 'font':2A,26B,37B,92C 'font-load':25B 'form':99C 'glyph':5A,43B,57B,61B,75B,95C,104C,110C,124C,132C,134C,152C,204C 'greater':58B 'guix':1A,16A,28B,31B,84C 'gx':100C,106C 'header':102C,108C 'heap':8A 'larg':143C 'last':42B,60B,109C,123C,133C,136C 'load':27B,158C,189C 'loader':3A,34B,70B,87C,174C 'make':62B,135C 'malform':4A 'mcu':29B 'multipli':149C,162C 'narrow':197C 'never':88C 'overflow':9A 'page':38B,93C,101C,107C,129C 'pass':190C 'past':77B 'rang':6A,49B,96C 'read':35B,112C 'recomput':192C 'record':153C,205C 'reserv':156C 'resourc':33B,86C 'size':65B,154C 'small':81B,170C 'smaller':179C 'threadx':18A,23B 'too-smal':79B 'type':198C 'uncheck':164C 'underflow':139C 'unders':208C 'unsign':144C 'upper':120C 'valid':51B,126C 'valu':44B,171C 'verbatim':113C 'well':98C 'without':45B 'wrap':67B,167C 'write':71B,187C,200C","nicknames":[],"mitigations":[],"who_affected":"Firmware and embedded UI products built on Eclipse ThreadX GUIX that load GUIX Studio binary resources (themes or fonts) from removable media, updates or other input they did not produce. The wrap needs GX_EXTENDED_UNICODE_SUPPORT (e.g. CJK or emoji fonts) and is exploitable on 32-bit targets; the advisory says 64-bit builds have the bug but are not exploitable by this route. Products that only use resources compiled in at build time, or build with GX_DISABLE_BINARY_RESOURCE_SUPPORT, can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:36:12Z","by":"analyst","run_id":751},"products":{"at":"2026-10-25T03:36:12Z","by":"analyst","run_id":751},"how_to_check":{"at":"2026-10-25T03:36:12Z","by":"analyst","run_id":751},"who_affected":{"at":"2026-10-25T03:36:12Z","by":"analyst","run_id":751}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91189","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91189","severity":null,"published_at":"2026-10-20T15:17:36+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91189:751","url":null,"severity":null,"published_at":"2026-10-25T03:36:12+00:00","modified_at":"2026-10-25T03:36:12+00:00","first_seen_at":"2026-10-25T03:36:12+00:00","fetched_at":"2026-10-25T03:36:12+00:00","note":"Read GHSA-hgcj-22cg-4hfv and 6.5.2.202603 release notes (maintainer). Affected <= 6.5.1.202602a, fixed 6.5.2.202603. No exploitation or public PoC link seen; reporter demonstrated a 303-byte theme file hijacking a function pointer (not public). Skipped social search (niche embedded)."}],"documents":[{"id":3243,"url":"https://github.com/eclipse-threadx/guix/security/advisories/GHSA-hgcj-22cg-4hfv","title":"GHSA-hgcj-22cg-4hfv GUIX binary resource loader glyph range","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3245,"url":"https://github.com/eclipse-threadx/guix/releases","title":"GUIX release 6.5.2.202603 notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}