CVE-2026-103414

The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.

• CWE-787

• https://github.com/eclipse-threadx/guix/security/advisories/GHSA-m2f3-cv9x-68q7
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/358

Published

Oct 14, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103408A Stack Buffer Overflow vulnerability in the DHCP client in …8.8
• CVE-2026-103409A Missing authentication for critical function vulnerability…9.8
• CVE-2026-103410An Integer Overflow vulnerability in the DPI certificate sca…7.5
• CVE-2026-103411An Integer Underflow vulnerability in DhcpMessageDecoder in …7.1
• CVE-2026-103412Improper limitation of a pathname to a restricted directory …8.8
• CVE-2026-103413Improper input validation vulnerability in Apache Camel Kara…8.8
• CVE-2026-103415When a TLS 1.3 client processes a HelloRetryRequest, it copi…9.3
• CVE-2026-103416Out-of-bounds write via the TLS 1.3 handshake message cache …9.3
• CVE-2026-103417Firefox for iOS could autofill saved credentials into a new …5.5
• CVE-2026-103418Firefox for iOS directly interpolated the page’s HTML langua…8.8
• CVE-2026-103421The WPMobile.App – Android and iOS App Builder plugin for Wo…5.4
• CVE-2026-103422The AnyComment plugin for WordPress is vulnerable to Stored …7.2