# CVE-2026-92446: Eclipse ThreadX GUIX binary resource loader out-of-bounds read

Source: https://junglewise.ai/threats/cve-2026-92446-gx-binres-theme-load-and-gx-binres-font-load-take-the-resource-as  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-92446 · Severity: info · Published 2026-10-20

Eclipse ThreadX GUIX is a graphics library for embedded systems that loads binary resource files containing fonts and themes. A malformed or truncated resource file can cause the library to read past the end of allocated memory, either crashing the application or disclosing sensitive memory contents when attacker-controlled offsets are rendered to the screen. Exploitation requires loading an untrusted resource file, such as a user-supplied theme or firmware asset.

Technologies: [Eclipse ThreadX GUIX](https://junglewise.ai/threats/technologies/guix). Vendors: [Eclipse ThreadX](https://junglewise.ai/threats/vendors/eclipse-threadx).

## Quick answers

**Is CVE-2026-92446 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92446 being exploited in the wild.

**How severe is CVE-2026-92446?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Eclipse ThreadX GUIX <= 6.5.1.202602a.

**Is there a fix for CVE-2026-92446?** Yes: fixed in GUIX 6.5.2.202603. Until then: Load binary resources only from sources the product controls. Where binary resources are not used, build with GX_DISABLE_BINARY_RESOURCE_SUPPORT to remove the loaders. Use the extended entry points (`gx_binres_theme_load_ext`, `gx_binres_font_load_ext`, `gx_binres_pixelmap_load_ext`) which require the caller to provide resource length. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92446 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-92446?** Check whether you run Eclipse ThreadX GUIX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in GUIX 6.5.2.202603

Load binary resources only from sources the product controls. Where binary resources are not used, build with GX_DISABLE_BINARY_RESOURCE_SUPPORT to remove the loaders. Use the extended entry points (`gx_binres_theme_load_ext`, `gx_binres_font_load_ext`, `gx_binres_pixelmap_load_ext`) which require the caller to provide resource length.

## Technical details

The loader functions `gx_binres_theme_load()` and `gx_binres_font_load()` receive a buffer pointer but no length, and `GX_BINRES_DATA_INFO` contains no field to carry resource extent. File-declared record counts are not validated against actual resource size, and file-supplied offsets become pointers without bounds checking. An attacker can craft a resource declaring more glyphs than it contains, or supply an arbitrary glyph map offset to read memory at an attacker-chosen displacement from the resource base, which is then rendered to the screen.

## Affected products

- Eclipse ThreadX GUIX <= 6.5.1.202602a

## Timeline

- 2026-10-02: disclosed
- 2026-10-20: advisory
- 2026-10-20: patched: Fixed in 6.5.2.202603; no backport to 6.4.x

## References

- [https://github.com/eclipse-threadx/guix/security/advisories/GHSA-m779-jvp3-pmqr](https://github.com/eclipse-threadx/guix/security/advisories/GHSA-m779-jvp3-pmqr)

## Related threats

- [Eclipse ThreadX GUIX multi-line text view out-of-bounds read](https://junglewise.ai/threats/cve-2026-91057-gx-multi-line-text-view-display-info-get-reads-one-byte-past-the)
- [GUIX JPEG decoder buffer over-read and infinite loop](https://junglewise.ai/threats/cve-2026-92454-the-guix-software-jpeg-decoder-reads-four-kinds-of-marker-segment)
- [Eclipse ThreadX GUIX binary resource heap buffer overflow](https://junglewise.ai/threats/cve-2026-92449-gx-binres-pixelmap-table-load-in-the-guix-binary-resource-theme)
- [Eclipse ThreadX GUIX binary resource loader integer underflow in font parsing](https://junglewise.ai/threats/cve-2026-91189-the-guix-binary-resource-loader-never-checks-that-a-font-page-s)
- [Eclipse ThreadX GUIX PNG decoder heap overflow on duplicate IHDR](https://junglewise.ai/threats/cve-2026-91186-the-png-chunk-reader-has-no-notion-of-chunk-ordering-it-records)