CVE-2026-91059

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-91059

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91059.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-91059

Aliases

GHSA-cxf2-pgvg-pcw3

Published

2026-10-20T14:54:37Z

Modified

2026-10-21T03:00:11Z

Severity

6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size

Details

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GX_SUCCESS and publishes a GX_PIXELMAP whose reported dimensions and data_size exceed the allocation behind it.

Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path.

Reproduces in the shipped default configuration; GX_SOFTWARE_DECODER_SUPPORT is enabled by default.

Database specific

{
    "cna_assigner":  "eclipse",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91059.json"
}

References

Affected packages

Git / github.com/eclipse-threadx/guix

Affected ranges

Type

GIT

Repo

https://github.com/eclipse-threadx/guix

Events

Introduced

Last Affected

52c1bb406843eb556d26dc28c65b13434f64e0ef

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "6.5.1.202602a"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v6.*

v6.0.1_rel

v6.0.2_rel

v6.0_rel

v6.1.10_rel

v6.1.11_rel

v6.1.12_rel

v6.1.3_rel

v6.1.4_rel

v6.1.5_rel

v6.1.6_rel

v6.1.7_rel

v6.1.8_rel

v6.1.9_rel

v6.1_rel

v6.2.0_rel

v6.2.1_rel

v6.3.0_rel

v6.4.0_rel

v6.4.1_rel

v6.4.2_rel

v6.4.3.202503_rel

v6.4.5.202504_rel

v6.5.1.202602_rel

v6.5.1.202602a_rel

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91059.json"