CVE-2026-91189High· 7.1▾ TwilightThe GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validate…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
The GUIX binary resource loader never checks that a font page's glyph range is well formed. gx_page_header_first_glyph and gx_page_header_last_glyph are read verbatim from the file and only the upper bound of last_glyph is validated, so a page declaring first_glyph > last_glyph makes last - first + 1 underflow to a very large unsigned count.
That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
GUIX <= 6.5.1.202602aRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-95107High· 7.0Module object allocation size overflow corrupts the manager object pool
CVE-2026-91186High· 8.4PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
CVE-2026-92449Medium· 6.8Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena
CVE-2026-103414High· 8.4The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic
CVE-2026-102729Medium· 5.9`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id
CVE-2026-91057Medium· 4.6Out-of-bounds read when a multi-line text view string ends with a carriage return