CVE-2026-92446
CVE-2026-92446 · GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded. This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.
CVSS 6.8 · Средний · EPSS 0,2% · Есть исправление
- Опубликовано
- Обновлено
Затронутые продукты и версии
eclipse threadx - guix
- Версии
- ≥ 0, ≤ 6.5.1.202602a: Затронуто (semver)
- 6.5.2.202603: Не затронуто
Обновитесь до 6.5.2.202603