CVE-2026-91059
Received Received - Intake

GUIX JPEG Decoder Buffer Overflow Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Eclipse Foundation

Description
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it. Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path. Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-91059
EUVD
EUVD-2026-105042

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Eclipse Foundation Eclipse ThreadX - GUIX 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The GUIX JPEG software decoder does not enforce proper ordering of JPEG markers. A malformed JPEG file can place a second SOF0 frame header after the SOS marker, causing the decoder to re-parse the frame header after the output buffer is allocated. This leads to a pixelmap structure reporting incorrect dimensions and data size that exceed the actual memory allocation. Consumers trusting this structure may read out-of-bounds memory, including GUIX display drivers.

Detection Guidance

Detecting this vulnerability requires checking for GUIX JPEG software decoder versions prior to 6.5.2.202603. Inspect installed GUIX libraries or binaries for version information. No direct network detection commands are provided, but validating software versions and configurations is critical.

Impact Analysis

This vulnerability can cause heap memory to be read beyond allocated bounds. Potential impacts include disclosure of adjacent heap content on the display or system faults. Attackers could craft malicious JPEG files to trigger these issues, affecting systems using GUIX with software decoder support enabled.

Mitigation Strategies

Upgrade GUIX to version 6.5.2.202603 or later to enforce JPEG marker ordering and prevent the vulnerability. Alternatively, disable the software decoder by setting GX_SOFTWARE_DECODER_SUPPORT to disabled. Only decode images from trusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart