CVE-2026-92454

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating. Both reproduce in the default configuration, in which `GX_SOFTWARE_DECODER_SUPPORT` is enabled.

• CWE-125
• CWE-835

• https://github.com/eclipse-threadx/guix/security/advisories/GHSA-pppm-h3g4-986x

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92438The Ninja Forms WordPress plugin 3.15.3 does not escape subm…8.8
• CVE-2026-9244Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-92446`gx_binres_theme_load()` and `gx_binres_font_load()` take th…6.8
• CVE-2026-92449`_gx_binres_pixelmap_table_load()` in the GUIX binary resour…6.8
• CVE-2026-9245Improper input validation in the external authentication pro…5
• CVE-2026-92450The authentication framework used by affected Kiloview E3 ND…7.5
• CVE-2026-92455yshop-crm through 2.1.3 fails to enforce authorization on th…4.3
• CVE-2026-92456yshop-crm through 2.1.3 fails to enforce authorization on th…7.1
• CVE-2026-92457yshop-crm through 2.1.3 contains a missing authorization vul…6.5
• CVE-2026-92458yshop-crm through 2.1.3 contains a missing authorization vul…4.3
• CVE-2026-92459yshop-crm through 2.1.3 contains a missing authorization vul…6.5
• CVE-2026-9246Improper access control in the entry documentation and attac…4.3