# CVE-2026-91189: Eclipse ThreadX GUIX binary resource loader integer underflow in font parsing

Source: https://junglewise.ai/threats/cve-2026-91189-the-guix-binary-resource-loader-never-checks-that-a-font-page-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-91189 · Severity: info · Published 2026-10-20

Eclipse ThreadX GUIX is a graphics library for embedded systems that loads fonts and themes from binary resource files. A malformed font file can trigger an integer underflow in the resource loader, causing a heap buffer overflow that allows an attacker to corrupt memory and execute arbitrary code on the target device.

Technologies: [Eclipse ThreadX GUIX](https://junglewise.ai/threats/technologies/guix). Vendors: [Eclipse ThreadX](https://junglewise.ai/threats/vendors/eclipse-threadx).

## Quick answers

**Is CVE-2026-91189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91189 being exploited in the wild.

**How severe is CVE-2026-91189?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Eclipse ThreadX GUIX <= 6.5.1.202602a.

**Is there a fix for CVE-2026-91189?** Yes: fixed in GUIX 6.5.2.202603. Until then: Disable GX_BINARY_RESOURCE_SUPPORT if binary resource loading is not required, or restrict loading of font and theme files to trusted sources only. Avoid loading untrusted or user-supplied binary resource files. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91189 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-91189?** Check whether you run Eclipse ThreadX GUIX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in GUIX 6.5.2.202603

Disable GX_BINARY_RESOURCE_SUPPORT if binary resource loading is not required, or restrict loading of font and theme files to trusted sources only. Avoid loading untrusted or user-supplied binary resource files.

## Technical details

The binary resource loader fails to validate that a font page's first_glyph field is less than or equal to last_glyph, causing an unsigned integer underflow when computing the glyph count. This count is multiplied by the glyph record size without overflow checking, wrapping to a small buffer allocation. The load pass then uses a narrower integer type that truncates the count, writing significantly more glyph records than allocated space, causing heap corruption. The vulnerability is exploitable on 32-bit ARM MCU builds but self-limiting on 64-bit systems.

## Affected products

- Eclipse ThreadX GUIX <= 6.5.1.202602a

## Timeline

- 2026-10-02: disclosed: GitHub advisory published
- 2026-10-20: advisory: NVD entry published
- 2026-10-03: patched: Fixed in GUIX 6.5.2.202603

## References

- [https://github.com/eclipse-threadx/guix/security/advisories/GHSA-hgcj-22cg-4hfv](https://github.com/eclipse-threadx/guix/security/advisories/GHSA-hgcj-22cg-4hfv)

## Related threats

- [Eclipse ThreadX GUIX multi-line text view out-of-bounds read](https://junglewise.ai/threats/cve-2026-91057-gx-multi-line-text-view-display-info-get-reads-one-byte-past-the)
- [GUIX JPEG decoder buffer over-read and infinite loop](https://junglewise.ai/threats/cve-2026-92454-the-guix-software-jpeg-decoder-reads-four-kinds-of-marker-segment)
- [Eclipse ThreadX GUIX binary resource heap buffer overflow](https://junglewise.ai/threats/cve-2026-92449-gx-binres-pixelmap-table-load-in-the-guix-binary-resource-theme)
- [Eclipse ThreadX GUIX binary resource loader out-of-bounds read](https://junglewise.ai/threats/cve-2026-92446-gx-binres-theme-load-and-gx-binres-font-load-take-the-resource-as)
- [Eclipse ThreadX GUIX PNG decoder heap overflow on duplicate IHDR](https://junglewise.ai/threats/cve-2026-91186-the-png-chunk-reader-has-no-notion-of-chunk-ordering-it-records)