# CVE-2026-91059: GUIX JPEG decoder out-of-bounds read via malformed marker ordering

Source: https://junglewise.ai/threats/cve-2026-91059-the-guix-jpeg-software-decoder-enforces-no-ordering-on-jpeg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-91059 · Severity: info · Published 2026-10-20

GUIX is a real-time embedded graphics framework that decodes JPEG images for display. A malformed JPEG file with duplicate frame headers can cause the decoder to return image metadata that mismatches the actual memory allocation, leading to out-of-bounds reads when the image is displayed. An attacker who can provide malicious JPEG files could leak adjacent heap memory or cause a fault.

Technologies: [Eclipse ThreadX GUIX](https://junglewise.ai/threats/technologies/guix). Vendors: [Eclipse ThreadX](https://junglewise.ai/threats/vendors/eclipse-threadx).

## Quick answers

**Is CVE-2026-91059 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91059 being exploited in the wild.

**How severe is CVE-2026-91059?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Eclipse ThreadX GUIX <= 6.5.1.202602a.

**Is there a fix for CVE-2026-91059?** Yes: fixed in GUIX 6.5.2.202603. Until then: The decoder now enforces marker ordering: duplicate SOF0 markers, frame headers after SOS, and SOS without a preceding frame header are all rejected with GX_INVALID_FORMAT. Ensure GX_SOFTWARE_DECODER_SUPPORT is enabled and only decode JPEG images from trusted sources until upgraded.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-02"}, {"kind": "advisory", "at": "2026-10-20"}, {"kind": "patched", "at": "2026-10-20", "note": "Fixed in 6.5.2.202603; no backport to 6.4.x per security policy"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91059 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-91059?** Check whether you run Eclipse ThreadX GUIX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in GUIX 6.5.2.202603

The decoder now enforces marker ordering: duplicate SOF0 markers, frame headers after SOS, and SOS without a preceding frame header are all rejected with GX_INVALID_FORMAT. Ensure GX_SOFTWARE_DECODER_SUPPORT is enabled and only decode JPEG images from trusted sources until upgraded.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-02"}, {"kind": "advisory", "at": "2026-10-20"}, {"kind": "patched", "at": "2026-10-20", "note": "Fixed in 6.5.2.202603; no backport to 6.4.x per security policy"}]

## Technical details

The JPEG software decoder lacks validation of marker ordering and allows a second SOF0 (start-of-frame) marker after SOS (start-of-scan), which re-runs the frame header parser after the output buffer has been allocated. The pixelmap structure then reports dimensions and data_size that exceed the actual allocation, causing any consumer to read out of bounds. This is a read-only defect; the write path clamps to the original clip rectangle and does not write out of bounds.

## Affected products

- Eclipse ThreadX GUIX <= 6.5.1.202602a

## References

- [https://github.com/eclipse-threadx/guix/security/advisories/GHSA-cxf2-pgvg-pcw3](https://github.com/eclipse-threadx/guix/security/advisories/GHSA-cxf2-pgvg-pcw3)

## Related threats

- [Eclipse ThreadX GUIX multi-line text view out-of-bounds read](https://junglewise.ai/threats/cve-2026-91057-gx-multi-line-text-view-display-info-get-reads-one-byte-past-the)
- [GUIX JPEG decoder buffer over-read and infinite loop](https://junglewise.ai/threats/cve-2026-92454-the-guix-software-jpeg-decoder-reads-four-kinds-of-marker-segment)
- [Eclipse ThreadX GUIX binary resource heap buffer overflow](https://junglewise.ai/threats/cve-2026-92449-gx-binres-pixelmap-table-load-in-the-guix-binary-resource-theme)
- [Eclipse ThreadX GUIX binary resource loader out-of-bounds read](https://junglewise.ai/threats/cve-2026-92446-gx-binres-theme-load-and-gx-binres-font-load-take-the-resource-as)
- [Eclipse ThreadX GUIX binary resource loader integer underflow in font parsing](https://junglewise.ai/threats/cve-2026-91189-the-guix-binary-resource-loader-never-checks-that-a-font-page-s)