CVE-2026-103414
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes…
- Risk score
- 51/100
- CVSS
- 8.4 v4.0
- Exploit chance (30 days)
- 0.2%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gx_page_header_data_size is never validated against the glyph data a page actually contains, the two passes can read different page headers for the…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.4 high
References
Original description
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.
Last activity 14 Oct 2026. Patch Forecast updates every hour.