CVE-2026-102729

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

• CWE-131
• CWE-787

• https://github.com/eclipse-threadx/guix/security/advisories/GHSA-372w-c338-xj8p

Published

Sep 29, 2026

Last Modified

Sep 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102723NULL Pointer Dereference on MSRP Attribute Table Exhaustion6
• CVE-2026-102724NULL Pointer Dereference When Evicting the Sole MSRP Attribu…6
• CVE-2026-102725Out-of-bounds Read from Unvalidated MSRP Attribute List Leng…6
• CVE-2026-102726Unbounded PPP IPCP Option Parsing Causes a Worker Stall and …6
• CVE-2026-102727FTP Passive Data Connection Not Bound to the Authenticated C…6
• CVE-2026-102728Two client-side TLS/DTLS handshake parsers in NetX Secure re…
• CVE-2026-10273A vulnerability was found in php-censor up to 2.1.6. This af…7.3
• CVE-2026-102730Mounting an attacker-controlled NAND flash image (`lx_nand_f…8.6
• CVE-2026-10274A vulnerability was determined in indrasishbanerjee aem-mcp-…6.3
• CVE-2026-10275A flaw has been found in OpenSC up to 0.26.1. This affects t…5
• CVE-2026-102757An unprivileged, memory-protected ThreadX module can have th…8.5
• CVE-2026-102758The `_nx_secure_x509_asn1_tlv_block_parse()` function parses…