CVE-2026-91189
CVE-2026-91189 · GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count. That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
CVSS 7.1 · Alta · EPSS 0,1% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
eclipse threadx - guix
- Versiones
- ≥ 0, ≤ 6.5.1.202602a: Afectada (semver)
- 6.5.2.202603: No afectada
Actualiza a 6.5.2.202603