Buffer Overrun Vulnerability in GUIX Affects Image Processing

CVE-2026-91186

What is CVE-2026-91186?

A significant vulnerability exists in the PNG chunk reader of GUIX, where improper handling of chunk ordering allows for a buffer overrun. The vulnerability is triggered when a PNG file includes a second IHDR chunk after the IDAT, which rewrites critical image properties such as dimensions and depth after the allocated buffer is already filled. This discrepancy can lead to unexpected behavior, including the potential for data corruption or application crashes. It's crucial for users and developers to ensure their systems are updated to mitigate any risks associated with this vulnerability.

References