Aller au contenu
en Se connecter
6.8 Moyenne

CVE-2026-92446 `gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and…

Description

`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded. This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.

Produits et versions touchés

Produit Versions touchées Corrigé en
Eclipse ThreadX - GUIX 6.5 premières → 6.5.1.202602a 6.5.2.202603

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Eclipse ThreadX - GUIX

Les 7 CVE de Eclipse ThreadX - GUIX →
CVE-2026-91057 `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the… 4.6 Moyenne CVE-2026-92454 The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what… 6.1 Moyenne CVE-2026-91059 The GUIX JPEG software decoder enforces no ordering on JPEG markers 6.8 Moyenne CVE-2026-91189 The GUIX binary resource loader never checks that a font page's glyph range is well formed 7.1 Élevée
Suivre cette CVE