4.6
Medium
CVE-2026-91057 `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the…
Description
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in `_gx_multi_line_text_view_string_total_rows_compute()` and a row of text that is not in the source.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse ThreadX - GUIX 6.5 | earliest → 6.5.1.202602a | 6.5.2.202603 |
Other CVEs of Eclipse ThreadX - GUIX
The 7 CVEs of Eclipse ThreadX - GUIX →
CVE-2026-92454
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what…
6.1
Medium
CVE-2026-91059
The GUIX JPEG software decoder enforces no ordering on JPEG markers
6.8
Medium
CVE-2026-91189
The GUIX binary resource loader never checks that a font page's glyph range is well formed
7.1
High
CVE-2026-92446
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and…
6.8
Medium