Buffer Overflow Vulnerability in GUIX Theme Loader by Eclipse

CVE-2026-92449

What is CVE-2026-92449?

The GUIX binary resource loader contains a vulnerability in the _gx_binres_pixelmap_table_load() function, which improperly indexes the pixelmap table using an unchecked value from the resource file. This flaw allows an attacker to craft a theme that could lead to a buffer overflow, enabling writes of up to approximately 256 KB beyond the table's end. Since the memory for the overflowed buffer is allocated by GUIX's internal memory management, the integrity of the memory arena can be compromised. Importantly, the public API function gx_binres_theme_load() lacks a size parameter, making it impossible for developers to safeguard against this issue, particularly as GX_BINARY_RESOURCE_SUPPORT is enabled by default in shipped configurations.

References