31 matches found
SUSE CVE-2026-92446
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
CVE-2026-92446
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
CVE-2026-92449
gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...
CVE-2026-92446
The GUIX binary resource loader contains an out-of-bounds read vulnerability within the gx_binres_theme_load() and gx_binres_font_load() functions. The root cause is that these functions accept resources as a bare GX_UBYTE * without a length, and the GX_BINRES_DATA_INFO structure lacks a field to...
CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
EUVD-2026-105037
gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...
CVE-2026-92449
The GUIX binary resource (theme) loader contains a heap out-of-bounds write vulnerability in the _gx_binres_pixelmap_table_load() function. The root cause is the lack of bounds checking on the map_id value read directly from a resource file when indexing the pixelmap table . A crafted theme file ...
CVE-2026-92449 Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...
CVE-2026-92449
"gxbinrespixelmaptableload" in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...
CVE-2026-92449 Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...
CVE-2026-92449 Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...
EUVD-2026-105036
gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...
Eclipse ThreadX GUIX buffer error vulnerability
Eclipse ThreadX GUIX versions 6.5.1.202602a and earlier contain a buffer error vulnerability. This vulnerability arises because gxbinresthemeload and gxbinresfontload handle resources as GXUBYTE without specifying their length; moreover, GXBINRESDATAINFO lacks a field to record this length. As a...
CVE-2026-103414
The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...
CVE-2026-103414
The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...
CVE-2026-103414
The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...
CVE-2026-103414
The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page...
CVE-2026-103414
The GUIX binary resource theme loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because "gxpageheaderdatasize" is never validated against the glyph data a page actually contains, the two passes can read different pa...