Eclipse ThreadX GUIX CVE-2026-92449

Exploitation requires the target application to call the GUIX public API gx_binres_theme_load() on an attacker-crafted binary theme (resource) file, with GX_BINARY_RESOURCE_SUPPORT compiled in - which is the default. The concrete trigger is a pixelmap table index field read verbatim from the resource file that is never bounds-checked against the table size. Limiting factors: the attack vector is local (AV:L) and requires active interaction (UI:A), so the attacker must be able to deliver a theme file into a code path the product actually exercises - this is only reachable in products that load externally-supplied or user-replaceable themes; devices that bake a trusted theme into firmware and never load external resources are not exposed. No network vector and no privilege is required once a malicious theme reaches the loader.

The supplied CVSS 4.0 vector (6.8, Medium) is the dominant signal: AV:L/UI:A means this is not a remote drive-by - an attacker must get a crafted GUIX binary theme file onto the device and cause the application to load it, with active user/application interaction. VI:H/VA:H with VC:L reflects a heap out-of-bounds write (CWE-129) that corrupts GUIX's own allocator arena, giving strong integrity/availability impact but little direct confidentiality loss. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation - this reads as a real but not emergency-priority defect. One structural aggravator stands out and should be weighed above the raw score: the public API gx_binres_theme_load() takes no size parameter, so no amount of caller diligence can prevent the overflow, and the vulnerable path is in the shipped default configuration (GX_BINARY_RESOURCE_SUPPORT enabled). Conversely, the local vector and interaction requirement sharply limit real-world reach to attack models where theme files are attacker-influenced. Key missing data: no EPSS, no SSVC decision point, and no KEV status were provided - exploitation likelihood is therefore inferred from the vector and description only, not measured.

An attacker crafts a malicious GUIX binary theme (binres) file containing an out-of-range pixelmap table index and gets the target embedded application to load it via gx_binres_theme_load() - for example a device that accepts user-supplied or downloadable themes/skins. Loading the file drives a write of up to roughly 256 KB past the end of the pixelmap table into GUIX's own memory arena, corrupting the heap and enabling denial of service or potential code execution. No public exploit code is identified at time of analysis.