{"id":"CVE-2026-92446","title":"GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader","summary":"`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, agai…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Eclipse Foundation","product":"GUIX","affected":["GUIX <= 6.5.1.202602a"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T15:26:01.270098Z"},"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T15:26:36.082Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92446","references":[{"url":"https://github.com/eclipse-threadx/guix/security/advisories/GHSA-m779-jvp3-pmqr"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T15:09:24.114Z","slug":"CVE-2026-92446","body":"## Overview\n\n`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded.\n\n\n\nThis is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.\n\n## Affected\n\n- `GUIX <= 6.5.1.202602a`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}