Skip to content
fr Sign in
6.1 Medium

CVE-2026-92454 The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what…

Description

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.

Affected products and versions

Product Affected versions Fixed in
Eclipse ThreadX - GUIX 6.5 earliest → 6.5.1.202602a 6.5.2.202603

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Eclipse ThreadX - GUIX

The 7 CVEs of Eclipse ThreadX - GUIX →
CVE-2026-91057 `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the… 4.6 Medium CVE-2026-91059 The GUIX JPEG software decoder enforces no ordering on JPEG markers 6.8 Medium CVE-2026-91189 The GUIX binary resource loader never checks that a font page's glyph range is well formed 7.1 High CVE-2026-92446 `gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and… 6.8 Medium
Track this CVE