---
id: "CVE-2026-92449"
kind: "vulnerability"
aliases: ["CVE-2026-92449"]
title: "GUIX theme loader: crafted resource file writes past pixelmap table"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["azure-rtos", "embedded", "guix", "other"]
not_affected_if: ["binary-resource-support-disabled", "static-resources-only"]
published_at: "2026-10-20T15:17:36+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:44:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92449", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# GUIX theme loader: crafted resource file writes past pixelmap table

The GUIX binary resource (theme) loader uses an index read from the resource file without a bounds check, so a crafted theme can write up to roughly 256 KB past the end of a table. The overflow corrupts GUIX's own heap arena, which can crash the device or, depending on what is overwritten, lead to code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92449

## From the sources

`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.



The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.



Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_