CVE-2026-102729CWE-131CWE-787

CVE-2026-102729

published September 29, 2026

CVSS
5.9
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

The record
Technical detail
CVSS
5.9 · NONE
CVSS v4.0
5.9 · CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00117 · 1.6th percentile
Weaknesses
CWE-131 · Incorrect Calculation of Buffer Size; CWE-787 · Out-of-bounds Write
Published
2026-09-29T22:17Z
References (1)
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 17:58Z
    `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id
    cvelistv5