Buffer Overflow in GUIX Theme Loader by Eclipse Foundation

CVE-2026-103414

What is CVE-2026-103414?

The vulnerability arises from the way the GUIX theme loader manages resource files, specifically due to a lack of validation in the size of glyph data. This flaw allows the system to misinterpret the glyph count, leading to a scenario where data may be written beyond the allocated buffer. Because the allocation is internally managed by GUIX, ensuring secure memory handling becomes crucial. The vulnerability can be easily reproduced in the default configuration of GUIX when the GX_BINARY_RESOURCE_SUPPORT feature is enabled, making it a significant concern for users relying on this framework.

References