All vulnerabilities
CVE-2026-103414GHSA-m2f3-cv9x-68q7

The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` i

Eclipse Foundation GUIX
Open in ThreatlineRecord JSON
CVSS
8.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.5.2.202603Fixed versionGitHub
Published14 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

  • 6.5.2.202603GUIX, eclipse threadxGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gx_page_header_data_size is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file.

The overflowed buffer is allocated by GUIX itself, through _gx_system_memory_allocator, rather than supplied by the caller. The public API gx_binres_theme_load() takes no size parameter, so no amount of caller diligence prevents this.

Reproduces in the shipped default configuration; GX_BINARY_RESOURCE_SUPPORT is enabled by default.

Text from GitHub Advisory Database

Affected versions 3

  • GUIXaffected: all versions through 6.5.1.202602aCVE List
  • GUIXunaffected: 6.5.2.202603CVE List
  • GUIX, eclipse threadx<= 6.5.1.202602aGitHub

References 2