{"id":"CVE-2026-103414","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-103414","generatedAt":"2026-10-28T01:11:47.443Z","title":"The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller.","description":"The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file.\n\n\n\nThe overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this.\n\n\n\nReproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default.","published":"2026-10-14T18:17:20.000Z","lastModified":"2026-10-16T21:17:13.000Z","status":"Awaiting Analysis","sourceIdentifier":"emo@eclipse.org","cvss":{"version":"4.0","score":8.4,"severity":"HIGH","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-787"],"affected":[],"epss":{"score":0.0016,"percentile":0.05104,"date":"2026-10-26","history":[{"date":"2026-10-15","score":0.0016,"percentile":0.04678}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T18:17:20.000Z","detail":{"score":"8.4","severity":"HIGH","publishedAt":"2026-10-14T18:17:19.637Z"},"summary":"New CVE, high severity (CVSS 8.4)."}],"references":[{"url":"https://github.com/eclipse-threadx/guix/security/advisories/GHSA-m2f3-cv9x-68q7","source":"emo@eclipse.org"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/358","source":"emo@eclipse.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-103414","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}