CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-92446?
CVE-2026-92446 is a medium-severity vulnerability in Eclipse ThreadX - GUIX, published on 20 Oct 2026.
Official description
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded.
This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.
Weakness: CWE-125
Which versions are affected by CVE-2026-92446?
How do I fix CVE-2026-92446?
No fix has been published for CVE-2026-92446 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92446 being exploited?
There is no known exploitation of CVE-2026-92446 in the wild and no public exploit code.
Sources
Also known as GHSA-m779-jvp3-pmqr.