CVE-2026-91057
Received Received - Intake

Buffer Over-Read in ThreadX GUIX Multi-Line Text View

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
`_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return (`\r`). The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in `_gx_multi_line_text_view_string_total_rows_compute()` and a row of text that is not in the source.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-91057
EUVD
EUVD-2026-105126

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse ThreadX - GUIX 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in the Eclipse ThreadX GUIX library's `_gx_multi_line_text_view_display_info_get()` function. When a multi-line text string ends with a carriage return (` `), the function reads one byte past the end of the text buffer. This can cause two issues: a one-byte out-of-bounds read and advancing the index past the string's end, leading to a second over-read in another function. The issue occurs because the function checks for line terminators without verifying if a subsequent byte exists.

Detection Guidance

To detect this vulnerability, check if your system uses Eclipse ThreadX GUIX library versions up to 6.5.1.202602a. Inspect the library version in your application or system dependencies. No specific commands are provided, but verify the version against the affected range.

Impact Analysis

The impact is limited to robustness and availability issues. The read byte is not attacker-controlled, so there is no direct security risk like data exposure. However, it may cause the application to read invalid memory, potentially leading to crashes or unexpected behavior. The vulnerability affects all GUIX releases from v6.0_rel onwards.

Mitigation Strategies

Upgrade to GUIX library version 6.5.2.202603 or later. As a workaround, set GX_STYLE_TEXT_COPY on the widget or ensure application text does not end with a lone carriage return.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91057. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart