Live › vulnerability › CVE-2026-92454
Go to dashboardThe GUIX software JPEG decoder reads four kinds of marker segment without checking their length, so a truncated segment is read past the end of the image buffer. A zero chroma sampling factor also makes the block decode loop never finish, which can hang the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built with the GUIX software JPEG decoder that decode JPEG images from untrusted sources. The sources describe the bug as reproducing in the default configuration, where is enabled, so a default build is exposed. Teams that never decode attacker-supplied JPEGs with GUIX are unlikely to be reached.
GX_SOFTWARE_DECODER_SUPPORTNo product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which GX_SOFTWARE_DECODER_SUPPORT is enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-92454")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.