CVE-2026-103414
8.4HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
- Impact
- Full C/I/A compromise
- Weakness
- CWE-787
Impact
Attackers can execute arbitrary code or crash the system by tricking a user into loading a malicious binary theme file. They only need local access or user interaction to supply the file.
Root cause
The binary resource loader calculates allocation sizes and writes glyph data using inconsistent cursor arithmetic across two passes, allowing unvalidated page headers to cause a heap buffer overflow in the GUIX-managed arena.
Affected systems
Eclipse ThreadX GUIX (exact versions not listed in the advisory).
CVSS v4.0 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Check the vendor advisory for patched versions or commits. If patching must wait, disable binary resource support by recompiling GUIX without GX_BINARY_RESOURCE_SUPPORT or avoid passing untrusted files to gx_binres_theme_load().
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.