{"id":"CVE-2026-92446","kind":"vulnerability","aliases":["CVE-2026-92446"],"related":[],"title":"GUIX embedded GUI library: binary resource loader reads past buffer end","description":"`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded.\n\n\n\nThis is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.","summary":"The GUIX theme and font loaders take a binary resource pointer with no length, so a crafted resource that declares more data than it holds makes the loader read past its buffer. Offsets stored in the file are turned into pointers without bounds checks, which can crash the device or leak adjacent memory.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","firmware","guix","package"],"not_affected_if":["no-untrusted-resource-input","resources-compiled-in"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T15:17:36+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:44:45+00:00","updated_at":"2026-10-25T03:44:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:44:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"GUIX embedded GUI library: binary resource loader reads past buffer end","impact":"medium","summary":"The GUIX theme and font loaders take a binary resource pointer with no length, so a crafted resource that declares more data than it holds makes the loader read past its buffer. Offsets stored in the file are turned into pointers without bounds checks, which can crash the device or leak adjacent memory.","category":"package","nicknames":[],"who_cares":["guix","embedded","firmware"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Out-of-bounds memory read from the device; possible crash or information leak","analyst_note":"Find the affected GUIX versions and the fixed release from the vendor advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-92446.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["resources-compiled-in","no-untrusted-resource-input"],"who_is_affected":"Embedded applications that load GUIX binary resources (themes and fonts) from a source an attacker can influence, such as external storage, network downloads or user-supplied files. Products that only load resources compiled into firmware from a trusted build are less exposed. The sources do not name affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000593,"input_tokens":3463,"output_tokens":494,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92446':14A,17A '22cg':166C '4hfv':167C 'adjac':73B 'bare':89C 'binari':5A,30B 'binr':76C,81C,97C 'bound':64B,156C 'buffer':10A,53B,120C 'carri':104C 'check':65B 'chose':117C 'contain':136C 'count':173C 'craft':38B 'crash':68B 'cve':12A,15A 'data':43B,98C,133C 'declar':41B,131C 'defect':161C 'devic':70B 'distinct':160C 'embed':2A,18B 'end':11A,141C 'everi':106C 'extent':122C 'field':102C 'file':58B,115C,148C 'firmwar':19B 'font':26B,82C 'form':186C 'ghsa':164C 'ghsa-hgcj-22cg-4hfv':163C 'glyph':172C,188C 'gui':3A 'guix':1A,20B,23B 'gx':75C,80C,90C,96C 'hgcj':165C 'hold':46B 'info':99C 'know':127C 'leak':72B 'length':35B,94C 'librari':4A 'load':78C,83C 'loader':7A,27B,49B,124C 'make':47B 'memori':74B 'multipli':181C 'narrow':187C 'need':175C 'offset':54B,113C,144C 'one':105C 'packag':21B 'past':9A,51B,139C 'perfect':183C 'perform':110C 'pointer':32B,62B,153C 'rang':189C 'reach':190C 'read':8A,50B,107C,138C 'resourc':6A,31B,39B,86C,129C 'store':55B,145C 'take':28B,84C 'theme':24B,77C 'therefor':109C 'turn':60B,150C 'ubyt':91C 'underflow':171C,177C 'well':185C 'well-form':184C 'whose':121C 'without':63B,154C 'wrap':180C","nicknames":[],"mitigations":[],"who_affected":"Embedded applications that load GUIX binary resources (themes and fonts) from a source an attacker can influence, such as external storage, network downloads or user-supplied files. Products that only load resources compiled into firmware from a trusted build are less exposed. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92446","severity":null,"published_at":"2026-10-20T15:17:36+00:00","modified_at":"2026-10-20T19:48:50+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}