CVE-2026-92454: JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which GXSOFTWAREDECODERSUPPORT is enabled.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the Microsoft GUIX software JPEG decoder are exposed when they process attacker-controlled or malformed JPEG image data. The issue reproduces with the default configuration because GX_SOFTWARE_DECODER_SUPPORT is enabled.
What does an attacker need to exploit it?
An attacker needs a victim application to decode a crafted JPEG. Truncated marker segments can cause reads past the caller's image buffer, while a JPEG with a zero chroma sampling factor can cause decoding to hang; user interaction is required according to the supplied severity vector.
What happens if a device processes a malicious JPEG?
A truncated marker segment can expose data beyond the caller-provided image buffer through an out-of-bounds read. A zero chroma sampling factor can cause a non-terminating block decode loop, resulting in a denial of service.