[ CVE-2026-92454 · Published 20 Oct 2026 ]
Vulnerability in Eclipse Foundation Eclipse ThreadX - GUIX
CVSS 6.1
EPSS <1%No fix listed yet
[ Description ]Official description
The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.