Eclipse ThreadX GUIX CVE-2026-92446

Exploitation requires the application to load an attacker-controlled or malformed GUIX binary resource - a theme via gx_binres_theme_load() or a font via gx_binres_font_load() - where the resource declares more data than it contains or embeds an out-of-range offset. The trigger needs no count underflow and no integer-multiply wrap: a well-formed, narrow glyph range is sufficient. Limiting factors: the vector is LOCAL (AV:L) and requires active user/application interaction (UI:A) to load the crafted resource, so there is no remote network path; realistic risk concentrates in deployments that load GUIX resources from external, removable, or otherwise untrusted storage rather than fixed, build-time-embedded resources.

This is a genuine but context-dependent memory-safety defect, not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) establishes a LOCAL attack vector that requires active user interaction - specifically, the target application must be induced to load an attacker-crafted binary resource - which sharply limits mass or remote exploitation. Impact is split: VC:H reflects the out-of-bounds read disclosing adjacent memory (consistent with CWE-125 and the 'Information Disclosure' tag), and VA:H reflects likely crashes/denial of service when an out-of-range offset is dereferenced; VI:N correctly indicates no integrity/code-write primitive is claimed. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no current signal of real-world exploitation or weaponization. The base score of 6.8 (Medium) aligns with a locally-triggered, interaction-gated memory-disclosure/DoS bug. Note one tension to verify: PR:N labels this unauthenticated, yet exploitation realistically depends on controlling the resource file the device loads, which in many deployments is a privileged or supply-side position - treat 'unauthenticated' as literal to the CVSS metric, not as 'trivially remote.'

An attacker supplies a malicious GUIX binary resource (a crafted theme or font file) that declares more data than it actually contains, and the embedded application loads it through gx_binres_theme_load() or gx_binres_font_load(). Because the loader never receives the buffer length, it reads past the resource's end and converts a file-chosen offset into an unbounded pointer, leaking adjacent memory or crashing the device. No public exploit is identified at time of analysis, and the local vector plus required resource-load interaction constrains this to scenarios where the attacker can influence the resource file.