Quick answers
- Is CVE-2026-91059 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-91059 being exploited in the wild.
- How severe is CVE-2026-91059?
- Informational severity, published 20 October 2026.
- Which products and versions are affected?
- Eclipse ThreadX GUIX <= 6.5.1.202602a.
- Is there a fix for CVE-2026-91059?
- Yes: fixed in GUIX 6.5.2.202603. Until then: The decoder now enforces marker ordering: duplicate SOF0 markers, frame headers after SOS, and SOS without a preceding frame header are all rejected with GX_INVALID_FORMAT. Ensure GX_SOFTWARE_DECODER_SUPPORT is enabled and only decode JPEG images from trusted sources until upgraded.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-02"}, {"kind": "advisory", "at": "2026-10-20"}, {"kind": "patched", "at": "2026-10-20", "note": "Fixed in 6.5.2.202603; no backport to 6.4.x per security policy"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-91059 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-91059?
- Check whether you run Eclipse ThreadX GUIX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: GUIX 6.5.2.202603
The decoder now enforces marker ordering: duplicate SOF0 markers, frame headers after SOS, and SOS without a preceding frame header are all rejected with GX_INVALID_FORMAT. Ensure GX_SOFTWARE_DECODER_SUPPORT is enabled and only decode JPEG images from trusted sources until upgraded.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-02"}, {"kind": "advisory", "at": "2026-10-20"}, {"kind": "patched", "at": "2026-10-20", "note": "Fixed in 6.5.2.202603; no backport to 6.4.x per security policy"}]
Technical details
The JPEG software decoder lacks validation of marker ordering and allows a second SOF0 (start-of-frame) marker after SOS (start-of-scan), which re-runs the frame header parser after the output buffer has been allocated. The pixelmap structure then reports dimensions and data_size that exceed the actual allocation, causing any consumer to read out of bounds. This is a read-only defect; the write path clamps to the original clip rectangle and does not write out of bounds.
Affected products
- Eclipse ThreadX GUIX <= 6.5.1.202602a