6.1
Moyenne
CVE-2026-92454 The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what…
Description
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Eclipse ThreadX - GUIX 6.5 | premières → 6.5.1.202602a | 6.5.2.202603 |
Autres CVE de Eclipse ThreadX - GUIX
Les 7 CVE de Eclipse ThreadX - GUIX →
CVE-2026-91057
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the…
4.6
Moyenne
CVE-2026-91059
The GUIX JPEG software decoder enforces no ordering on JPEG markers
6.8
Moyenne
CVE-2026-91189
The GUIX binary resource loader never checks that a font page's glyph range is well formed
7.1
Élevée
CVE-2026-92446
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and…
6.8
Moyenne