CVE-2026-102729
Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Eclipse Foundation

Description
`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-10-19
AI Q&A
2026-09-29
EPSS Evaluated
2026-10-18
NVD
CVE-2026-102729
EUVD
EUVD-2026-89200

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation GUIX 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a function `gx_binres_theme_load()` that incorrectly handles theme buffer allocation. When a theme ID is provided that exceeds the declared theme count in a resource, it allocates a zero-byte buffer. The function then reads past the end of the theme table, misinterprets subsequent data as a theme header, and writes theme data into the zero-byte buffer, causing a buffer overflow.

Detection Guidance

This vulnerability involves a buffer overflow in the gx_binres_theme_load() function due to improper theme buffer sizing. Detection requires code analysis or runtime monitoring for out-of-bounds memory access in the theme loading process. No specific network or system commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by exploiting the buffer overflow. It may lead to system crashes, data corruption, or unauthorized access if the affected software processes maliciously crafted theme resources.

Compliance Impact

This vulnerability could potentially lead to unauthorized memory access or corruption, which may result in data leaks or integrity issues. Such risks could impact compliance with standards like GDPR (data protection) or HIPAA (healthcare data privacy) by compromising confidentiality or availability of sensitive data.

Mitigation Strategies

Update or patch the affected software component to a version where the theme buffer handling is fixed. Avoid using untrusted theme resources or inputs until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102729. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart