CVE-2026-102729

MediumCVSS 5.9

Published: 29/09/2026(UTC)Updated: 29/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

Risk Assessment

Risk of buffer overflow and memory corruption, potentially leading to system crash or unauthorized code execution.

Recommendation

Update the GUIX library to a patched version and ensure applications do not use invalid theme IDs.

Other vulnerabilities in GUIX

CVE-2026-103414High
The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS