Aller au contenu
en Se connecter
6.8 Moyenne

CVE-2026-92449 `_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value…

Description

`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.

Produits et versions touchés

Produit Versions touchées Corrigé en
Eclipse ThreadX - GUIX 6.5 premières → < 6.5.2.202603 6.5.2.202603
Eclipse ThreadX - GUIX 6.3 6.3.0 → 6.5.1.202602a Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Eclipse ThreadX - GUIX

Les 7 CVE de Eclipse ThreadX - GUIX →
CVE-2026-91057 `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the… 4.6 Moyenne CVE-2026-92454 The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what… 6.1 Moyenne CVE-2026-91059 The GUIX JPEG software decoder enforces no ordering on JPEG markers 6.8 Moyenne CVE-2026-91189 The GUIX binary resource loader never checks that a font page's glyph range is well formed 7.1 Élevée
Suivre cette CVE