6.8
Moyenne
CVE-2026-91059 The GUIX JPEG software decoder enforces no ordering on JPEG markers
Description
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it. Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path. Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Eclipse ThreadX - GUIX 6.5 | premières → 6.5.1.202602a | 6.5.2.202603 |
Autres CVE de Eclipse ThreadX - GUIX
Les 7 CVE de Eclipse ThreadX - GUIX →
CVE-2026-91057
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the…
4.6
Moyenne
CVE-2026-92454
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what…
6.1
Moyenne
CVE-2026-91189
The GUIX binary resource loader never checks that a font page's glyph range is well formed
7.1
Élevée
CVE-2026-92446
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and…
6.8
Moyenne