CVE-2026-92449 `_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-92449?
CVE-2026-92449 is a medium-severity vulnerability in Eclipse ThreadX - GUIX, published on 20 Oct 2026.
Official description
`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table.
The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller, so the loader corrupts its own arena. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.
Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.
Which versions are affected by CVE-2026-92449?
How do I fix CVE-2026-92449?
No fix has been published for CVE-2026-92449 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92449 being exploited?
There is no known exploitation of CVE-2026-92449 in the wild and no public exploit code.
Sources
Also known as GHSA-m85v-2ccm-w6gf.