CVE-2026-103414

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103414
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103414.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103414
Aliases
  • GHSA-m2f3-cv9x-68q7
Published
2026-10-14T17:32:12Z
Modified
2026-10-15T02:47:18Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gx_page_header_data_size is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file.

The overflowed buffer is allocated by GUIX itself, through _gx_system_memory_allocator, rather than supplied by the caller. The public API gx_binres_theme_load() takes no size parameter, so no amount of caller diligence prevents this.

Reproduces in the shipped default configuration; GX_BINARY_RESOURCE_SUPPORT is enabled by default.

Database specific 
{
    "cna_assigner":  "eclipse",
    "cwe_ids":  [
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103414.json"
}
References

Affected packages

Git / github.com/eclipse-threadx/guix

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-threadx/guix
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
52c1bb406843eb556d26dc28c65b13434f64e0ef
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "6.5.1.202602a"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v6.*
v6.0.1_rel
v6.0.2_rel
v6.0_rel
v6.1.10_rel
v6.1.11_rel
v6.1.12_rel
v6.1.3_rel
v6.1.4_rel
v6.1.5_rel
v6.1.6_rel
v6.1.7_rel
v6.1.8_rel
v6.1.9_rel
v6.1_rel
v6.2.0_rel
v6.2.1_rel
v6.3.0_rel
v6.4.0_rel
v6.4.1_rel
v6.4.2_rel
v6.4.3.202503_rel
v6.4.5.202504_rel
v6.5.1.202602_rel
v6.5.1.202602a_rel

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103414.json"