---
id: CVE-2026-92446
title: >-
  GUIX binary resource loader reads past the end of a resource, because no
  length for it ever reaches the loader
summary: >-
  `gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a
  bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to
  carry one. Every read is therefore performed at an offset the file itself
  chose, agai…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-125
vendor: Eclipse Foundation
product: GUIX
affected:
  - GUIX <= 6.5.1.202602a
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-20T15:26:01.270098Z'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T15:26:36.082Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-92446'
references:
  - url: >-
      https://github.com/eclipse-threadx/guix/security/advisories/GHSA-m779-jvp3-pmqr
tags:
  - cve.org
ingestedAt: '2026-10-20T15:09:24.114Z'
---

## Overview

`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded.



This is a distinct defect from GHSA-hgcj-22cg-4hfv, which was an underflowed glyph count. It needs no underflow and no wrapped multiply: a perfectly well-formed, narrow glyph range reaches it.

## Affected

- `GUIX <= 6.5.1.202602a`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.