CVE-2026-91189: Eclipse ThreadX GUIX binary resource loader integer underflow in font parsing

CVE-2026-91189 · Severity: info · Published 2026-10-20

Eclipse ThreadX GUIX is a graphics library for embedded systems that loads fonts and themes from binary resource files. A malformed font file can trigger an integer underflow in the resource loader, causing a heap buffer overflow that allows an attacker to corrupt memory and execute arbitrary code on the target device.

Technologies: Eclipse ThreadX GUIX. Vendors: Eclipse ThreadX.

Quick answers

Is CVE-2026-91189 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-91189 being exploited in the wild.
How severe is CVE-2026-91189?
Informational severity, published 20 October 2026.
Which products and versions are affected?
Eclipse ThreadX GUIX <= 6.5.1.202602a.
Is there a fix for CVE-2026-91189?
Yes: fixed in GUIX 6.5.2.202603. Until then: Disable GX_BINARY_RESOURCE_SUPPORT if binary resource loading is not required, or restrict loading of font and theme files to trusted sources only. Avoid loading untrusted or user-supplied binary resource files. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91189 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-91189?
Check whether you run Eclipse ThreadX GUIX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: GUIX 6.5.2.202603

Disable GX_BINARY_RESOURCE_SUPPORT if binary resource loading is not required, or restrict loading of font and theme files to trusted sources only. Avoid loading untrusted or user-supplied binary resource files.

Technical details

The binary resource loader fails to validate that a font page's first_glyph field is less than or equal to last_glyph, causing an unsigned integer underflow when computing the glyph count. This count is multiplied by the glyph record size without overflow checking, wrapping to a small buffer allocation. The load pass then uses a narrower integer type that truncates the count, writing significantly more glyph records than allocated space, causing heap corruption. The vulnerability is exploitable on 32-bit ARM MCU builds but self-limiting on 64-bit systems.

Affected products

  • Eclipse ThreadX GUIX <= 6.5.1.202602a

Timeline

  • 2026-10-02: disclosed: GitHub advisory published
  • 2026-10-20: advisory: NVD entry published
  • 2026-10-03: patched: Fixed in GUIX 6.5.2.202603

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.