CVE-2026-103414: Eclipse Foundation ThreadX GUIX vulnerability
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because gxpageheaderdatasize is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file.
The overflowed buffer is allocated by GUIX itself, through gxsystemmemoryallocator, rather than supplied by the caller. The public API gxbinresthemeload() takes no size parameter, so no amount of caller diligence prevents this.
Reproduces in the shipped default configuration; GXBINARYRESOURCESUPPORT is enabled by default.
Affected Software
Event History
Frequently Asked Questions
Are applications using the default configuration exposed?
Yes. The issue reproduces in the shipped default configuration because GX_BINARY_RESOURCE_SUPPORT is enabled by default.
What must an attacker control to trigger the overflow?
An attacker needs to cause the application to load a crafted GUIX binary resource theme through gx_binres_theme_load(). The overflow data is taken directly from the resource file.
Can an application prevent this by validating the buffer passed to the loader?
No. gx_binres_theme_load() does not take a size parameter, and the vulnerable arena is allocated internally by GUIX through _gx_system_memory_allocator.