CVE-2026-92446— GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
Quick assessment
Affected
Eclipse Foundation Eclipse ThreadX - GUIX
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
和 函数将资源作为不带长度信息的裸 指针接收，而 结构体中也没有用于传递该长度信息的字段。因此，所有读取操作均依据文件自身指定的偏移量执行，且针对一个加载器并不知晓其边界范围的缓冲区进行。若某个资源声明的数据量超过其实际包含的内容，读取操作便会越过其末尾；同时，文件中存储的偏移量会在未进行边界检查的情况下直接转换为指针。 此缺陷与 GHSA-hgcj-22cg-4hfv（涉及字形计数下溢）性质不同：它无需依赖下溢或回绕乘法即可触发；即使是一个完全合法且范围狭窄的字形区间，也足以触发该漏洞。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92446
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
Source: CVE Program / CVE List V5
Vulnerability Description
`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded.
This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse ThreadX - GUIX | 0 ~ 6.5.1.202602a | - |
|
II. Public POCs for CVE-2026-92446
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92446
请登录查看更多情报信息。
Other References for CVE-2026-92446 (1)
Same Patch Batch · Eclipse Foundation · 2026-10-20 · 29 CVEs total
| CVE-2026-113620 | 9.8 CRITICAL | Eclipse ioFog operator WebSocket accepts an unverified JWT |
| CVE-2026-93475 | 9.3 CRITICAL | Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509 |
| CVE-2026-94018 | 8.8 HIGH | NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Lengt |
| CVE-2026-92853 | 8.7 HIGH | Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure |
| CVE-2026-92843 | 8.7 HIGH | Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure |
| CVE-2026-95109 | 8.5 HIGH | Cortex-A7 module data validation checks only the first address of a caller-supplied range |
| CVE-2026-94192 | 8.5 HIGH | Module object deallocation can free a live ThreadX kernel object |
| CVE-2026-91186 | 8.4 HIGH | PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing |
| CVE-2026-91041 | 7.8 HIGH | FileX fault-tolerant log replay writes past the destination sector when mounting a crafted |
| CVE-2026-113619 | 7.5 HIGH | Eclipse ioFog renders request templates before authentication |
| CVE-2026-91189 | 7.1 HIGH | GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a hea |
| CVE-2026-95107 | 7.0 HIGH | Module object allocation size overflow corrupts the manager object pool |
| CVE-2026-93003 | 6.9 MEDIUM | NetX Duo Web HTTP server interprets request body content as HTTP header fields |
| CVE-2026-108062 | 6.9 MEDIUM | Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event |
| CVE-2026-94023 | 6.9 MEDIUM | Module delete dispatchers do not enforce kernel-object ownership before irreversible delet |
| CVE-2026-94024 | 6.9 MEDIUM | Module Manager object lookup validates one byte of a module's search name |
| CVE-2026-91059 | 6.8 MEDIUM | JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allo |
| CVE-2026-92449 | 6.8 MEDIUM | Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds wri |
| CVE-2026-95108 | 6.8 MEDIUM | Deleting a user-mode module thread leaks its privileged kernel stack |
| CVE-2026-97400 | 6.8 MEDIUM | jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when ope |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Eclipse ThreadX - GUIX
-
CVE-2026-91057
Out-of-bounds read when a multi-line text view string ends w -
CVE-2026-92454
JPEG decoder: truncated segments are read past the image buf -
CVE-2026-91059
JPEG decoder: a duplicate SOF0 after SOS publishes a pixelma -
CVE-2026-91189
GUIX binary resource loader: unvalidated glyph range causes -
CVE-2026-92449
Binary resource loader: unbounded map_id from a theme file c
Same vendor: Eclipse Foundation
-
CVE-2026-93003
NetX Duo Web HTTP server interprets request body content as -
CVE-2026-95107
Module object allocation size overflow corrupts the manager -
CVE-2026-94202
Module block-pool create validates two of the four parameter -
CVE-2026-95108
Deleting a user-mode module thread leaks its privileged kern -
CVE-2026-94024
Module Manager object lookup validates one byte of a module'
Same weakness: CWE-125
-
CVE-2026-94202
Module block-pool create validates two of the four parameter -
CVE-2026-94024
Module Manager object lookup validates one byte of a module' -
CVE-2026-94023
Module delete dispatchers do not enforce kernel-object owner -
CVE-2026-95109
Cortex-A7 module data validation checks only the first addre -
CVE-2026-92843
Out-of-bounds Read via the TLS 1.3 Certificate extensions_le
V. Comments for CVE-2026-92446
No comments yet