CVE-2026-92449

The GUIX binary resource (theme) loader contains a heap out-of-bounds write vulnerability in the _gx_binres_pixelmap_table_load() function. The root cause is the lack of bounds checking on the map_id value read directly from a resource file when indexing the pixelmap table . A crafted theme file ...

CVE-2026-92449 Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena

gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...