All vulnerabilities
CVE-2026-92454GHSA-pppm-h3g4-986x

Eclipse ThreadX - GUIX: JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode

Eclipse Foundation Eclipse ThreadX - GUIX
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.5.2.202603Fixed versionGitHub
Published20 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 6.5.2.202603GUIX, eclipse threadxGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which GX_SOFTWARE_DECODER_SUPPORT is enabled.

Text from CVE List

Affected versions 3

  • Eclipse ThreadX - GUIXaffected: all versions through 6.5.1.202602aCVE List
  • Eclipse ThreadX - GUIXunaffected: 6.5.2.202603CVE List
  • GUIX, eclipse threadx<= 6.5.1.202602aGitHub

References 1