Memory Management Vulnerability in Eclipse ThreadX GUIX Resources

CVE-2026-92446

What is CVE-2026-92446?

The vulnerability arises from the inadequate handling of resource loading functions gx_binres_theme_load() and gx_binres_font_load() in Eclipse ThreadX's GUIX framework. These functions accept a resource as a bare GX_UBYTE * pointer without specifying its length, leading to potential buffer overflows. The absence of proper bounds checking permits reading beyond the intended data limit of resources, posing risks of memory corruption. This issue is distinct from previous vulnerabilities, as it does not involve underflow conditions. Attackers might exploit this flaw by crafting resources that declare excessive data, causing unintended memory access and possible application crashes.

References