Answer in brief
CVE-2026-91189 records a High severity (CVSS 7.1) vulnerability in GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme. The current sources do not mark it as known exploited. The current feed maps Eclipse Foundation/Eclipse ThreadX - GUIX (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Eclipse Foundation/Eclipse ThreadX - GUIX (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Eclipse Foundation/Eclipse ThreadX - GUIXgeneric | >=0 <=6.5.1.202602a | Not reported |
Published upstream
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 20, 2026
The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count. That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.
Quoted source text, attributed separately from HOL analysis.