Buffer Overflow Vulnerability in GUIX Binary Resource Loader

CVE-2026-91189

What is CVE-2026-91189?

A vulnerability exists in the GUIX binary resource loader where the glyph range of a font page is not properly validated. Specifically, the first_glyph and last_glyph values can lead to an underflow condition if a page specifies a range where first_glyph exceeds last_glyph. This mismanagement results in the loader allocating a significantly smaller buffer than necessary, exposing it to a buffer overflow vulnerability where attacker-controlled glyph records could be written into memory. This can lead to data corruption, potential code execution, or other malicious exploits.

References