CVE-2026-103414High· 8.4▾ TwilightThe GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph d…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 8.4
none → high
Last analysed / modified upstream
0.2%
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gx_page_header_data_size is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file.
The overflowed buffer is allocated by GUIX itself, through _gx_system_memory_allocator, rather than supplied by the caller. The public API gx_binres_theme_load() takes no size parameter, so no amount of caller diligence prevents this.
Reproduces in the shipped default configuration; GX_BINARY_RESOURCE_SUPPORT is enabled by default.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91186High· 8.4PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
CVE-2026-91189High· 7.1GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme
CVE-2026-92449Medium· 6.8Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
CVE-2026-102729Medium· 5.9`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id
CVE-2026-91057Medium· 4.6Out-of-bounds read when a multi-line text view string ends with a carriage return
CVE-2026-93475Critical· 9.3Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509