CVE-2026-103414

Awaiting Analysis Awaiting Analysis - Queue

GUIX Theme Loader Buffer Overflow Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Eclipse Foundation

Description

The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103414

EUVD

EUVD-2026-101497

Affected Vendors & Products

Vendor	Product	Version / Range
Eclipse	Foundation	GUIX 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-103414 is a heap out-of-bounds write vulnerability in the GUIX binary resource loader. The loader performs two separate passes to size and load font data from a resource file. Due to missing validation of page header data against actual glyph counts, the two passes may calculate different arena sizes. The write pass then overflows the buffer, writing attacker-controlled glyph data beyond the allocated memory.

Detection Guidance

Detecting this vulnerability requires checking the GUIX library version. Use commands like 'guix --version' or inspect the library file (e.g., libguix.so) for version details. Compare the version against 6.5.2.202603 to determine if the system is vulnerable.

Impact Analysis

An attacker could exploit this to corrupt heap memory, potentially leading to crashes, arbitrary code execution, or data corruption. Since the overflowed data includes glyph fields like dimensions and pointers, it may later be dereferenced during rendering, enabling further exploitation. The impact depends on the application's use of GUIX and the attacker's ability to provide malicious font files.

Compliance Impact

This vulnerability could lead to unauthorized memory access, potentially exposing sensitive data processed by GUIX, which may impact compliance with GDPR (data protection) and HIPAA (health data privacy) if such data is involved. The heap out-of-bounds write could allow attackers to read or manipulate memory, risking data breaches or integrity violations.

Mitigation Strategies

Upgrade GUIX to version 6.5.2.202603 or later. Avoid loading binary resource files from untrusted sources. If upgrading is not possible, restrict access to binary resource files to trusted users only.

Hi! I’m here to help you understand CVE-2026-103414. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70