# CVE-2026-92454: GUIX JPEG decoder buffer over-read and infinite loop

Source: https://junglewise.ai/threats/cve-2026-92454-the-guix-software-jpeg-decoder-reads-four-kinds-of-marker-segment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-92454 · Severity: medium · CVSS 6.1 · Published 2026-10-20

GUIX is a real-time embedded GUI framework that includes a software JPEG image decoder used on IoT and embedded devices. A malformed JPEG file can cause the decoder to read beyond the image buffer boundaries or enter an infinite loop, crashing the application or rendering the device unresponsive. An attacker can exploit this by providing a crafted JPEG that corrupts heap memory or triggers a denial-of-service condition.

Technologies: [Eclipse ThreadX GUIX](https://junglewise.ai/threats/technologies/guix). Vendors: [Eclipse ThreadX](https://junglewise.ai/threats/vendors/eclipse-threadx).

## Quick answers

**Is CVE-2026-92454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92454 being exploited in the wild.

**How severe is CVE-2026-92454?** Medium severity, with a CVSS score of 6.1, published 20 October 2026.

**Which products and versions are affected?** Eclipse ThreadX GUIX 6.5.1.202602a and earlier.

**Is there a fix for CVE-2026-92454?** Yes: fixed in GUIX 6.5.2.202603. Until then: Decode only JPEG images from trusted sources. Disable the software decoder by setting GX_SOFTWARE_DECODER_SUPPORT to 0 if the hardware decoder or external JPEG processing is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92454 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-92454?** Check whether you run Eclipse ThreadX GUIX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in GUIX 6.5.2.202603

Decode only JPEG images from trusted sources. Disable the software decoder by setting GX_SOFTWARE_DECODER_SUPPORT to 0 if the hardware decoder or external JPEG processing is available.

## Technical details

The GUIX JPEG decoder fails to validate segment lengths before reading from marker segments (DQT, SOF0, SOS, DRI), allowing out-of-bounds heap reads of up to 65 bytes. Additionally, zero or unchecked chroma sampling factors cause an infinite loop in the block decode routine. Both issues occur in the default configuration with GX_SOFTWARE_DECODER_SUPPORT enabled and are triggered by processing untrusted JPEG files; no memory safety safeguards prevent the out-of-bounds access, though the leaked bytes influence rendered output rather than being directly disclosed.

## Affected products

- Eclipse ThreadX GUIX 6.5.1.202602a and earlier

## Timeline

- 2026-10-02: disclosed
- 2026-10-20: advisory

## References

- [https://github.com/eclipse-threadx/guix/security/advisories/GHSA-pppm-h3g4-986x](https://github.com/eclipse-threadx/guix/security/advisories/GHSA-pppm-h3g4-986x)

## Related threats

- [Eclipse ThreadX GUIX multi-line text view out-of-bounds read](https://junglewise.ai/threats/cve-2026-91057-gx-multi-line-text-view-display-info-get-reads-one-byte-past-the)
- [Eclipse ThreadX GUIX binary resource heap buffer overflow](https://junglewise.ai/threats/cve-2026-92449-gx-binres-pixelmap-table-load-in-the-guix-binary-resource-theme)
- [Eclipse ThreadX GUIX binary resource loader out-of-bounds read](https://junglewise.ai/threats/cve-2026-92446-gx-binres-theme-load-and-gx-binres-font-load-take-the-resource-as)
- [Eclipse ThreadX GUIX binary resource loader integer underflow in font parsing](https://junglewise.ai/threats/cve-2026-91189-the-guix-binary-resource-loader-never-checks-that-a-font-page-s)
- [Eclipse ThreadX GUIX PNG decoder heap overflow on duplicate IHDR](https://junglewise.ai/threats/cve-2026-91186-the-png-chunk-reader-has-no-notion-of-chunk-ordering-it-records)