Eclipse ThreadX GUIX EUVD-2026-101497

Requires the target application to call the public API gx_binres_theme_load() on an attacker-controlled binary resource (theme) file in which a font page's gx_page_header_data_size is inconsistent with the glyph data the page actually contains; the two-pass loader then reserves less than it writes. GX_BINARY_RESOURCE_SUPPORT is enabled by default, so the shipped default configuration is vulnerable and no special build option is needed. LIMITING FACTORS: the attack vector is local - the attacker must get the crafted file onto the device and the application must actively load it (UI:A), so deployments that only load fixed theme resources compiled into firmware, or that never accept externally sourced theme files, are not exposed; there is no network-reachable path and no caller-side mitigation is possible because the API takes no buffer-size parameter.

This is a heap out-of-bounds write (CWE-787) in Eclipse ThreadX GUIX's binary theme resource loader, triggered by a malformed binary resource file whose per-page glyph data disagrees between the sizing pass and the load pass. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A, VC:H/VI:H/VA:H, score 8.4) is internally consistent with the description: exploitation is LOCAL and requires the victim/application to actively load (UI:A) an attacker-supplied theme file - it is NOT a remotely reachable network bug despite the high impact triple. No KEV listing, no EPSS score, and no public exploit (POC) are present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world priority is therefore moderate: the memory-corruption primitive is strong (verbatim file content written past a GUIX-allocated arena, with no caller-side size check possible because gx_binres_theme_load() takes no size parameter), but reachability depends on the application accepting untrusted/externally sourced theme files, which many embedded deployments do not do. Treat as a genuine code-execution risk for any device or app that loads themes from an untrusted channel; deprioritize where theme files are fixed and built into firmware.

An attacker crafts a malicious GUIX binary theme (.bin) resource in which a font page's gx_page_header_data_size and actual glyph data are inconsistent, then delivers it to a target device or application that loads themes from an external or user-controllable source. When the application calls gx_binres_theme_load() on the file, the load pass writes more glyph bytes than the sizing pass reserved, overflowing the GUIX-allocated arena with attacker-controlled file content and potentially achieving code execution. No public exploit code is identified at time of analysis, and exploitation requires the application to actively load the crafted file (local vector, user interaction).