---
id: "CVE-2026-92446"
kind: "vulnerability"
aliases: ["CVE-2026-92446"]
title: "GUIX embedded GUI library: binary resource loader reads past buffer end"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["embedded", "firmware", "guix", "package"]
not_affected_if: ["no-untrusted-resource-input", "resources-compiled-in"]
published_at: "2026-10-20T15:17:36+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:44:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92446", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# GUIX embedded GUI library: binary resource loader reads past buffer end

The GUIX theme and font loaders take a binary resource pointer with no length, so a crafted resource that declares more data than it holds makes the loader read past its buffer. Offsets stored in the file are turned into pointers without bounds checks, which can crash the device or leak adjacent memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92446

## From the sources

`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded.



This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_