CVE-2026-92449CWE-129CWE-457CWE-787

CVE-2026-92449

published October 20, 2026

CVSS
6.8
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.

The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.

Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.

The record
Technical detail
CVSS
6.8 · NONE
CVSS v4.0
6.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00159 · 4.6th percentile
Weaknesses
CWE-129 · Improper Validation of Array Index; CWE-457 · Use of Uninitialized Variable; CWE-787 · Out-of-bounds Write
Published
2026-10-20T19:17Z
References (1)
https://github.com/eclipse-threadx/guix/security/advisories/GHSA-m85v-2ccm-w6gf · [email protected]
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 0%
    epss
  • 20 OCT 14:51Z
    Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
    cvelistv5
  • 20 OCT 14:51Z
    Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
    cvelistv5