6.8
Medium
CVE-2026-91059 The GUIX JPEG software decoder enforces no ordering on JPEG markers
Description
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it. Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path. Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse ThreadX - GUIX 6.5 | earliest → 6.5.1.202602a | 6.5.2.202603 |
Other CVEs of Eclipse ThreadX - GUIX
The 7 CVEs of Eclipse ThreadX - GUIX →
CVE-2026-91057
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the…
4.6
Medium
CVE-2026-92454
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what…
6.1
Medium
CVE-2026-91189
The GUIX binary resource loader never checks that a font page's glyph range is well formed
7.1
High
CVE-2026-92446
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and…
6.8
Medium