Eclipse GUIX CVE-2026-91057

Exploitation requires the application to display a string that terminates with a carriage return (\r) inside a GUIX multi-line text view widget (the _gx_multi_line_text_view_* code path). The attacker must be able to control or influence the text content rendered in that widget, and - per UI:A - a user must actually render/view the widget for the over-read to trigger. Limiting factors: the vector is LOCAL (AV:L), so there is no remote/network trigger; the device must use GUIX multi-line text views; and impact is confined to a single-byte over-read plus a spurious display row (low confidentiality, low availability), with no integrity or code-execution primitive indicated by the data.

This is a genuinely low-to-moderate priority issue despite being a memory-safety bug. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L, score 4.6 Medium) tells a consistent story: exploitation is LOCAL (not network-reachable), requires active user interaction (a user must render/view the affected text view), and yields only LOW confidentiality impact (a single out-of-bounds byte / spurious row) and LOW availability impact (minor display corruption), with no integrity impact. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the input - no public exploit identified at time of analysis. The signals do not conflict: a local, UI-gated, one-byte over-read in an embedded GUI library is a correctness/robustness defect more than a weaponizable vulnerability. The classification tag 'Buffer Overflow' is somewhat loose - CWE-125 (out-of-bounds READ) is the accurate characterization, and there is no write primitive, so code execution is not indicated by the data. Realistic risk is bounded by the embedded, local, user-interaction-dependent nature of the flaw; it merits patching during normal maintenance rather than emergency response.

An application built on Eclipse ThreadX GUIX renders attacker-influenced text - ending in a carriage return (\r) - inside a multi-line text view widget. When the widget computes display info, GUIX reads one byte past the end of the string buffer and may advance its index, over-reading again and rendering an extra row sourced from adjacent memory, potentially disclosing a byte of neighboring data on the device. No public proof-of-concept exists; exploitation requires local control over the displayed string and a user viewing the widget.