Live › vulnerability › CVE-2026-92446
Go to dashboardThe GUIX theme and font loaders take a binary resource pointer with no length, so a crafted resource that declares more data than it holds makes the loader read past its buffer. Offsets stored in the file are turned into pointers without bounds checks, which can crash the device or leak adjacent memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Embedded applications that load GUIX binary resources (themes and fonts) from a source an attacker can influence, such as external storage, network downloads or user-supplied files. Products that only load resources compiled into firmware from a trusted build are less exposed. The sources do not name affected versions.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
gx_binres_theme_load() and gx_binres_font_load() take the resource as a bare GX_UBYTE * with no length, and GX_BINRES_DATA_INFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded.
This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.
This page as .md · .json · in your agent: get_signal("CVE-2026-92446")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.