6 matches found
EUVD-2026-105042
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GXSUCCESS and publishes a GXPIXELMAP whose...
CVE-2026-91059 JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GXSUCCESS and publishes a GXPIXELMAP whose...
CVE-2026-91059 JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GXSUCCESS and publishes a GXPIXELMAP whose...
CVE-2026-91059
The GUIX JPEG software decoder is vulnerable to an out-of-bounds read (CWE-125) because it does not enforce ordering on JPEG markers. A crafted file containing a second SOF0 frame header after an SOS marker causes the decoder to re-run the frame header parser after the output buffer is already al...
CVE-2026-91059
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second "SOF0" frame header after "SOS" re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns "GXSUCCESS" and publishes a "GXPIXELMAP...
CVE-2026-91059 JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GXSUCCESS and publishes a GXPIXELMAP whose...