CVE-2026-91057Medium· 4.6▾ Sunlit`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
_gx_multi_line_text_view_display_info_get() reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (\r). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in _gx_multi_line_text_view_string_total_rows_compute() and a row of text that is not in the source.
GUIX <= 6.5.1.202602aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91186High· 8.4PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
CVE-2026-92446Medium· 6.8GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
CVE-2026-91059Medium· 6.8JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size
CVE-2026-92454Medium· 6.1JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode
CVE-2026-111075High· 8.7JITServer: Pre-authentication remote crash via integer underflow and out-of-bounds heap read in DataDescriptor deserialization
CVE-2026-110938High· 8.7JITServer: Multiple Denial of Service vulnerabilities via out-of-bounds heap reads during message and reply parsing