CVE-2026-92446: Eclipse ThreadX GUIX binary resource loader out-of-bounds read

CVE-2026-92446 · Severity: info · Published 2026-10-20

Eclipse ThreadX GUIX is a graphics library for embedded systems that loads binary resource files containing fonts and themes. A malformed or truncated resource file can cause the library to read past the end of allocated memory, either crashing the application or disclosing sensitive memory contents when attacker-controlled offsets are rendered to the screen. Exploitation requires loading an untrusted resource file, such as a user-supplied theme or firmware asset.

Technologies: Eclipse ThreadX GUIX. Vendors: Eclipse ThreadX.

Quick answers

Is CVE-2026-92446 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92446 being exploited in the wild.
How severe is CVE-2026-92446?
Informational severity, published 20 October 2026.
Which products and versions are affected?
Eclipse ThreadX GUIX <= 6.5.1.202602a.
Is there a fix for CVE-2026-92446?
Yes: fixed in GUIX 6.5.2.202603. Until then: Load binary resources only from sources the product controls. Where binary resources are not used, build with GX_DISABLE_BINARY_RESOURCE_SUPPORT to remove the loaders. Use the extended entry points (`gx_binres_theme_load_ext`, `gx_binres_font_load_ext`, `gx_binres_pixelmap_load_ext`) which require the caller to provide resource length. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92446 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-92446?
Check whether you run Eclipse ThreadX GUIX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: GUIX 6.5.2.202603

Load binary resources only from sources the product controls. Where binary resources are not used, build with GX_DISABLE_BINARY_RESOURCE_SUPPORT to remove the loaders. Use the extended entry points (`gx_binres_theme_load_ext`, `gx_binres_font_load_ext`, `gx_binres_pixelmap_load_ext`) which require the caller to provide resource length.

Technical details

The loader functions `gx_binres_theme_load()` and `gx_binres_font_load()` receive a buffer pointer but no length, and `GX_BINRES_DATA_INFO` contains no field to carry resource extent. File-declared record counts are not validated against actual resource size, and file-supplied offsets become pointers without bounds checking. An attacker can craft a resource declaring more glyphs than it contains, or supply an arbitrary glyph map offset to read memory at an attacker-chosen displacement from the resource base, which is then rendered to the screen.

Affected products

  • Eclipse ThreadX GUIX <= 6.5.1.202602a

Timeline

  • 2026-10-02: disclosed
  • 2026-10-20: advisory
  • 2026-10-20: patched: Fixed in 6.5.2.202603; no backport to 6.4.x

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.