Eclipse ThreadX up to 6.5.1.202602a GUIX binary resource loader first_glyph/last_glyph buffer overflow

Summaryinfo

A vulnerability labeled as very critical has been found in Eclipse ThreadX up to 6.5.1.202602a. The affected element is the function gx_page_header_first_glyph/gx_page_header_last_glyph of the component GUIX binary resource loader. Executing a manipulation of the argument first_glyph/last_glyph can lead to buffer overflow. The identification of this vulnerability is CVE-2026-91189. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Eclipse ThreadX up to 6.5.1.202602a and classified as very critical. This vulnerability affects the function gx_page_header_first_glyph/gx_page_header_last_glyph of the component GUIX binary resource loader. The manipulation of the argument first_glyph/last_glyph with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count. That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-91189 since 09/23/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/20/2026).

Upgrading to version 6.5.2.202603 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-105040). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Eclipse

Name

• ThreadX

Version

• 6.5.1.202602a

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion