CVE-2026-91189: GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme
The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph > lastglyph makes last - first + 1 underflow to a very large unsigned count.
That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the flaw?
The attacker must cause GUIX to load an untrusted font or theme containing a font page whose first glyph value is greater than its last glyph value. Exploitation also relies on attacker-controlled glyph records being processed after the malformed range causes the allocation-size calculation to wrap.
Is user interaction required?
Yes. The supplied CVSS vector identifies user interaction as required (UI:A), indicating a user must take an action that results in the untrusted font or theme being loaded.
What is the likely impact if exploitation succeeds?
The malformed glyph range can lead to a heap out-of-bounds write. The provided CVSS vector rates confidentiality, integrity, and availability impacts as high.