Skip to content
fr Sign in
5.9 Medium

CVE-2026-102729 `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the…

Description

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

Affected products and versions

Product Affected versions Fixed in
GUIX 6.5 earliest → 6.5.1.202602a 6.5.2.202603

References

Timeline

  1. Published
  2. Last modified

Other CVEs of GUIX

The 2 CVEs of GUIX →
CVE-2026-103414 The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the… 8.4 High
Track this CVE