{"id":"CVE-2026-92454","title":"JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode","summary":"The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-125","CWE-835"],"vendor":"Eclipse Foundation","product":"GUIX","affected":["GUIX <= 6.5.1.202602a"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T15:21:00.502903Z"},"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T15:21:42.800Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92454","references":[{"url":"https://github.com/eclipse-threadx/guix/security/advisories/GHSA-pppm-h3g4-986x"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T15:09:24.109Z","slug":"CVE-2026-92454","body":"## Overview\n\nThe GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.\n\n## Affected\n\n- `GUIX <= 6.5.1.202602a`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}