Eclipse ThreadX up to 6.5.1.202602a JPEG software decoder out-of-bounds

Summaryinfo

A vulnerability identified as very critical has been detected in Eclipse ThreadX up to 6.5.1.202602a. Impacted is an unknown function of the component JPEG software decoder. Performing a manipulation results in out-of-bounds. This vulnerability was named CVE-2026-91059. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Eclipse ThreadX up to 6.5.1.202602a. This affects some unknown functionality of the component JPEG software decoder. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns `GX_SUCCESS` and publishes a `GX_PIXELMAP` whose reported dimensions and `data_size` exceed the allocation behind it. Any consumer that trusts the returned structure reads out of bounds, including GUIX's own display drivers, reached through the ordinary draw path. Reproduces in the shipped default configuration; `GX_SOFTWARE_DECODER_SUPPORT` is enabled by default.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-91059 since 09/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/20/2026).

Upgrading to version 6.5.2.202603 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-105042). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.5.1.202602a

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion