CVE-2026-91057 Out-of-bounds read when a multi-line text view string ends with a carriage return
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-91057?
CVE-2026-91057 is a medium-severity vulnerability in Eclipse ThreadX - GUIX, published on 20 Oct 2026.
Official description
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in `_gx_multi_line_text_view_string_total_rows_compute()` and a row of text that is not in the source.
Weakness: CWE-125
Which versions are affected by CVE-2026-91057?
How do I fix CVE-2026-91057?
No fix has been published for CVE-2026-91057 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-91057 being exploited?
There is no known exploitation of CVE-2026-91057 in the wild and no public exploit code.
Sources
Also known as GHSA-4qjc-2g93-36m2.