Live › vulnerability › CVE-2026-92449
Go to dashboardThe GUIX binary resource (theme) loader uses an index read from the resource file without a bounds check, so a crafted theme can write up to roughly 256 KB past the end of a table. The overflow corrupts GUIX's own heap arena, which can crash the device or, depending on what is overwritten, lead to code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on GUIX (Azure RTOS GUIX embedded graphics) that load theme or binary resource files through gx_binres_theme_load(), with GX_BINARY_RESOURCE_SUPPORT enabled, which is the default. Exposure depends on whether untrusted or externally supplied theme files can reach the loader. Teams that only load fixed, built-in resources are less exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
_gx_binres_pixelmap_table_load() in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed buffer is allocated by GUIX itself, through _gx_system_memory_allocator, rather than supplied by the caller, so the loader corrupts its own arena. The public API gx_binres_theme_load() takes no size parameter, so no amount of caller diligence prevents this.
Reproduces in the shipped default configuration; GX_BINARY_RESOURCE_SUPPORT is enabled by default.
This page as .md · .json · in your agent: get_signal("CVE-2026-92449")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.