CVE-2026-92454: GUIX JPEG decoder buffer over-read and infinite loop

CVE-2026-92454 · Severity: medium · CVSS 6.1 · Published 2026-10-20

GUIX is a real-time embedded GUI framework that includes a software JPEG image decoder used on IoT and embedded devices. A malformed JPEG file can cause the decoder to read beyond the image buffer boundaries or enter an infinite loop, crashing the application or rendering the device unresponsive. An attacker can exploit this by providing a crafted JPEG that corrupts heap memory or triggers a denial-of-service condition.

Technologies: Eclipse ThreadX GUIX. Vendors: Eclipse ThreadX.

Quick answers

Is CVE-2026-92454 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92454 being exploited in the wild.
How severe is CVE-2026-92454?
Medium severity, with a CVSS score of 6.1, published 20 October 2026.
Which products and versions are affected?
Eclipse ThreadX GUIX 6.5.1.202602a and earlier.
Is there a fix for CVE-2026-92454?
Yes: fixed in GUIX 6.5.2.202603. Until then: Decode only JPEG images from trusted sources. Disable the software decoder by setting GX_SOFTWARE_DECODER_SUPPORT to 0 if the hardware decoder or external JPEG processing is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92454 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-92454?
Check whether you run Eclipse ThreadX GUIX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: GUIX 6.5.2.202603

Decode only JPEG images from trusted sources. Disable the software decoder by setting GX_SOFTWARE_DECODER_SUPPORT to 0 if the hardware decoder or external JPEG processing is available.

Technical details

The GUIX JPEG decoder fails to validate segment lengths before reading from marker segments (DQT, SOF0, SOS, DRI), allowing out-of-bounds heap reads of up to 65 bytes. Additionally, zero or unchecked chroma sampling factors cause an infinite loop in the block decode routine. Both issues occur in the default configuration with GX_SOFTWARE_DECODER_SUPPORT enabled and are triggered by processing untrusted JPEG files; no memory safety safeguards prevent the out-of-bounds access, though the leaked bytes influence rendered output rather than being directly disclosed.

Affected products

  • Eclipse ThreadX GUIX 6.5.1.202602a and earlier

Timeline

  • 2026-10-02: disclosed
  • 2026-10-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.