CVE-2026-91059Medium· 6.8▾ SunlitThe GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched.…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GX_SUCCESS and publishes a GX_PIXELMAP whose reported dimensions and data_size exceed the allocation behind it.
Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path.
Reproduces in the shipped default configuration; GX_SOFTWARE_DECODER_SUPPORT is enabled by default.
GUIX <= 6.5.1.202602aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91057Medium· 4.6Out-of-bounds read when a multi-line text view string ends with a carriage return
CVE-2026-91186High· 8.4PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
CVE-2026-92446Medium· 6.8GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader
CVE-2026-92454Medium· 6.1JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode
CVE-2026-92853High· 8.7Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
CVE-2026-92843High· 8.7Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure